From 5e4d9bbc4b4e57eacb614c38f30dac9af08cace8 Mon Sep 17 00:00:00 2001 From: Simon Marchi Date: Tue, 2 Feb 2021 10:40:50 -0500 Subject: [PATCH] gdb/dwarf: fix bound check in read_rnglist_index I think this check in read_rnglist_index is wrong: /* Validate that reading won't go beyond the end of the section. */ if (start_offset + cu->header.offset_size > rnglist_base + section->size) error (_("Reading DW_FORM_rnglistx index beyond end of" ".debug_rnglists section [in module %s]"), objfile_name (objfile)); The addition `rnglist_base + section->size` doesn't make sense. rnglist_base is an offset into `section`, so it doesn't make sense to add it to `section`'s size. `start_offset` also is an offset into `section`, so we should just compare it to just `section->size`. gdb/ChangeLog: * dwarf2/read.c (read_rnglist_index): Fix bound check. Change-Id: If0ff7c73f4f80f79aac447518f4e8f131f2db8f2 --- gdb/ChangeLog | 4 ++++ gdb/dwarf2/read.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index dcbfc77761d..c71492d7a33 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,7 @@ +2021-02-02 Simon Marchi + + * dwarf2/read.c (read_rnglist_index): Fix bound check. + 2021-02-02 Simon Marchi * dwarf2/read.c (read_loclist_index): Change complaints into diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c index a9f7ce3a312..9a71329c990 100644 --- a/gdb/dwarf2/read.c +++ b/gdb/dwarf2/read.c @@ -20257,6 +20257,8 @@ read_rnglist_index (struct dwarf2_cu *cu, ULONGEST rnglist_index, : RNGLIST_HEADER_SIZE64); ULONGEST rnglist_base = (cu->dwo_unit != nullptr) ? rnglist_header_size : cu->ranges_base; + + /* Offset in .debug_rnglists of the offset for RNGLIST_INDEX. */ ULONGEST start_offset = rnglist_base + rnglist_index * cu->header.offset_size; @@ -20285,7 +20287,7 @@ read_rnglist_index (struct dwarf2_cu *cu, ULONGEST rnglist_index, objfile_name (objfile)); /* Validate that reading won't go beyond the end of the section. */ - if (start_offset + cu->header.offset_size > rnglist_base + section->size) + if (start_offset + cu->header.offset_size > section->size) error (_("Reading DW_FORM_rnglistx index beyond end of" ".debug_rnglists section [in module %s]"), objfile_name (objfile)); -- 2.30.2