From: Alan Modra <amodra@gmail.com>
Date: Thu, 13 May 2021 13:16:36 +0000 (+0930)
Subject: PR27861, Infinite loop in dwarf.c:7507-7526
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=b96a1bcb81078d6443666a59d6a91368ac03767f;p=binutils-gdb.git

PR27861, Infinite loop in dwarf.c:7507-7526

	PR 27861
	* dwarf.c (display_debug_str_offsets): Sanity check dwarf5
	header length.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 335c7d02fa8..85d21ebfa6b 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2021-05-13  Alan Modra  <amodra@gmail.com>
+
+	PR 27861
+	* dwarf.c (display_debug_str_offsets): Sanity check dwarf5
+	header length.
+
 2021-05-13  Alan Modra  <amodra@gmail.com>
 
 	PR 27860
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 20bd92657b3..b22d33c43dd 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -7487,7 +7487,14 @@ display_debug_str_offsets (struct dwarf_section *section,
 	}
       else
 	{
-	  entries_end = curr + length;
+	  if (length <= (dwarf_vma) (end - curr))
+	    entries_end = curr + length;
+	  else
+	    {
+	      warn (_("Section %s is too small %#lx\n"),
+		    section->name, (unsigned long) section->size);
+	      entries_end = end;
+	    }
 
 	  int version;
 	  SAFE_BYTE_GET_AND_INC (version, curr, 2, end);