From: Alan Modra <amodra@gmail.com>
Date: Thu, 5 Oct 2017 07:02:18 +0000 (+1030)
Subject: PR22239 - invalid memory read in display_debug_frames
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=9c0f3d3f2017829ffd908c9893b85094985c3b58;p=binutils-gdb.git

PR22239 - invalid memory read in display_debug_frames

Pointer comparisons have traps for the unwary.  After adding a large
unknown value to "start", the test "start < end" depends on where
"start" is originally in memory.

	PR 22239
	* dwarf.c (read_cie): Don't compare "start" and "end" pointers
	after adding a possibly wild length to "start", compare the length
	to the difference of the pointers instead.  Remove now redundant
	"negative" length test.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 490085c2117..21b4350fe91 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,11 @@
+2017-10-05  Alan Modra  <amodra@gmail.com>
+
+	PR 22239
+	* dwarf.c (read_cie): Don't compare "start" and "end" pointers
+	after adding a possibly wild length to "start", compare the length
+	to the difference of the pointers instead.  Remove now redundant
+	"negative" length test.
+
 2017-10-05  Tristan Gingold  <tgingold@free.fr>
 
 	* MAINTAINERS: Update email address.  Redirect release maintainer
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 7ded1bffc38..f8c726cb30e 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -7001,14 +7001,14 @@ read_cie (unsigned char *start, unsigned char *end,
     {
       READ_ULEB (augmentation_data_len);
       augmentation_data = start;
-      start += augmentation_data_len;
       /* PR 17512: file: 11042-2589-0.004.  */
-      if (start > end)
+      if (augmentation_data_len > (size_t) (end - start))
 	{
 	  warn (_("Augmentation data too long: %#lx, expected at most %#lx\n"),
-		augmentation_data_len, (long)((end - start) + augmentation_data_len));
+		augmentation_data_len, (unsigned long) (end - start));
 	  return end;
 	}
+      start += augmentation_data_len;
     }
 
   if (augmentation_data_len)
@@ -7021,14 +7021,7 @@ read_cie (unsigned char *start, unsigned char *end,
       q = augmentation_data;
       qend = q + augmentation_data_len;
 
-      /* PR 17531: file: 015adfaa.  */
-      if (qend < q)
-	{
-	  warn (_("Negative augmentation data length: 0x%lx"), augmentation_data_len);
-	  augmentation_data_len = 0;
-	}
-
-      while (p < end && q < augmentation_data + augmentation_data_len)
+      while (p < end && q < qend)
 	{
 	  if (*p == 'L')
 	    q++;