Fix potential integer overflow when reading corrupt dwarf1 debug information.

	PR 22894
	* dwarf1.c (parse_die): Check the length of form blocks before
	advancing the data pointer.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 446b978a7a8e2b25902472d91f5ecf8521c909ba..76a6499f6a251e629ee326655cec0f0818d82410 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-02-28  Nick Clifton  <nickc@redhat.com>
+
+       PR 22894
+       * dwarf1.c (parse_die): Check the length of form blocks before
+       advancing the data pointer.
+
 2018-02-28  Alan Modra  <amodra@gmail.com>
 
        PR 22887

diff --git a/bfd/dwarf1.c b/bfd/dwarf1.c
index 71bc57bfdf825092c3449ba8810b0efa7b54bb8b..f272ea831157dc16283774edb933492ca8d3cf48 100644 (file)
--- a/bfd/dwarf1.c
+++ b/bfd/dwarf1.c
@@ -213,6 +213,7 @@ parse_die (bfd *         abfd,
   /* Then the attributes.  */
   while (xptr + 2 <= aDiePtrEnd)
     {
+      unsigned int   block_len;
       unsigned short attr;
 
       /* Parse the attribute based on its form.  This section
@@ -255,12 +256,24 @@ parse_die (bfd *       abfd,
          break;
        case FORM_BLOCK2:
          if (xptr + 2 <= aDiePtrEnd)
-           xptr += bfd_get_16 (abfd, xptr);
+           {
+             block_len = bfd_get_16 (abfd, xptr);
+             if (xptr + block_len > aDiePtrEnd
+                 || xptr + block_len < xptr)
+               return FALSE;
+             xptr += block_len;
+           }
          xptr += 2;
          break;
        case FORM_BLOCK4:
          if (xptr + 4 <= aDiePtrEnd)
-           xptr += bfd_get_32 (abfd, xptr);
+           {
+             block_len = bfd_get_32 (abfd, xptr);
+             if (xptr + block_len > aDiePtrEnd
+                 || xptr + block_len < xptr)
+               return FALSE;
+             xptr += block_len;
+           }
          xptr += 4;
          break;
        case FORM_STRING: