From: Alan Modra <amodra@gmail.com>
Date: Wed, 1 Jul 2020 07:24:50 +0000 (+0930)
Subject: PR26188, buff overflow in coff_find_nearest_line_with_names
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=33d1369f183f1c276e3f0f52b5573fb2f5843b1c;p=binutils-gdb.git

PR26188, buff overflow in coff_find_nearest_line_with_names

	PR 26188
	* coffgen.c (coff_find_nearest_line_with_names): Sanity check
	raw syment index before dereferencing.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index fc6042e7f3c..b91df9985eb 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2020-07-01  Alan Modra  <amodra@gmail.com>
+
+	PR 26188
+	* coffgen.c (coff_find_nearest_line_with_names): Sanity check
+	raw syment index before dereferencing.
+
 2020-07-01  Alan Modra  <amodra@gmail.com>
 
 	* elf32-i386.c (elf_backend_object_p): Undef for vxworks.
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index 94589b43d2f..3291b693eb0 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -2435,11 +2435,15 @@ coff_find_nearest_line_with_names (bfd *abfd,
 
 		  /* In XCOFF a debugging symbol can follow the
 		     function symbol.  */
-		  if (s->u.syment.n_scnum == N_DEBUG)
+		  if (((size_t) ((char *) s - (char *) obj_raw_syments (abfd))
+		       < obj_raw_syment_count (abfd) * sizeof (*s))
+		      && s->u.syment.n_scnum == N_DEBUG)
 		    s = s + 1 + s->u.syment.n_numaux;
 
 		  /* S should now point to the .bf of the function.  */
-		  if (s->u.syment.n_numaux)
+		  if (((size_t) ((char *) s - (char *) obj_raw_syments (abfd))
+		       < obj_raw_syment_count (abfd) * sizeof (*s))
+		      && s->u.syment.n_numaux)
 		    {
 		      /* The linenumber is stored in the auxent.  */
 		      union internal_auxent *a = &((s + 1)->u.auxent);