aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2019-09-23 08:53:07 +0930
committerAlan Modra <amodra@gmail.com>2019-09-25 10:06:06 +0930
commita11b3493ca2d5aabdc218197b92026098d7e2f57 (patch)
treeaa3a688ad92fe18b76b14ef59dba6abd9750241b
parentWork around gcc10 FAIL: S-records with constructors (diff)
downloadbinutils-gdb-a11b3493ca2d5aabdc218197b92026098d7e2f57.tar.gz
binutils-gdb-a11b3493ca2d5aabdc218197b92026098d7e2f57.tar.bz2
binutils-gdb-a11b3493ca2d5aabdc218197b92026098d7e2f57.zip
PR25018, readelf crash on 32bits
Pointer comparisons after adding an offset just don't work to catch overflow when the offset is a larger type than the pointer. PR 25018 * dwarf.c (get_type_signedness): Delete ineffective pointer comparison check. Properly range check uvalue offset on recursive call. (read_and_display_attr_value): Range check uvalue offset before calling get_type_signedness. (cherry picked from commit b3fe587ed2c78d46132bd33e14f42449d410354b)
-rw-r--r--binutils/ChangeLog11
-rw-r--r--binutils/dwarf.c8
2 files changed, 15 insertions, 4 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 167e937f76..dd22321f8c 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,14 @@
+2019-09-25 Alan Modra <amodra@gmail.com>
+
+ Apply from master
+ 2019-09-23 Alan Modra <amodra@gmail.com>
+ PR 25018
+ * dwarf.c (get_type_signedness): Delete ineffective pointer
+ comparison check. Properly range check uvalue offset on
+ recursive call.
+ (read_and_display_attr_value): Range check uvalue offset before
+ calling get_type_signedness.
+
2019-09-19 Tamar Christina <tamar.christina@arm.com>
* testsuite/binutils-all/objdump.exp (objdump -S): Update testcase.
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index df924e4050..2fe469f060 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -1999,9 +1999,6 @@ get_type_signedness (unsigned char * start,
* is_signed = FALSE;
- if (data >= end)
- return;
-
abbrev_number = read_uleb128 (data, & bytes_read, end);
data += bytes_read;
@@ -2042,6 +2039,8 @@ get_type_signedness (unsigned char * start,
NB/ We need to avoid infinite recursion. */
return;
}
+ if (uvalue >= (size_t) (end - start))
+ return;
get_type_signedness (start, start + uvalue, end, pointer_size,
offset_size, dwarf_version, is_signed, TRUE);
break;
@@ -2725,7 +2724,8 @@ read_and_display_attr_value (unsigned long attribute,
switch (attribute)
{
case DW_AT_type:
- if (level >= 0 && level < MAX_CU_NESTING)
+ if (level >= 0 && level < MAX_CU_NESTING
+ && uvalue < (size_t) (end - start))
{
bfd_boolean is_signed = FALSE;