|
 |
58725c |
--- binutils.orig/bfd/dwarf1.c 2018-05-15 17:25:27.656131299 +0100
|
|
|
58725c |
+++ binutils-2.27/bfd/dwarf1.c 2018-05-15 17:29:04.176057372 +0100
|
|
|
58725c |
@@ -208,6 +208,7 @@ parse_die (bfd * abfd,
|
|
|
58725c |
/* Then the attributes. */
|
|
|
58725c |
while (xptr < (this_die + aDieInfo->length))
|
|
|
58725c |
{
|
|
|
58725c |
+ unsigned int block_len;
|
|
|
58725c |
unsigned short attr;
|
|
|
58725c |
|
|
|
58725c |
/* Parse the attribute based on its form. This section
|
|
|
58725c |
@@ -223,12 +224,15 @@ parse_die (bfd * abfd,
|
|
|
58725c |
break;
|
|
|
58725c |
case FORM_DATA4:
|
|
|
58725c |
case FORM_REF:
|
|
|
58725c |
- if (attr == AT_sibling)
|
|
|
58725c |
- aDieInfo->sibling = bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
- else if (attr == AT_stmt_list)
|
|
|
58725c |
+ if (xptr + 4 <= aDiePtrEnd)
|
|
|
58725c |
{
|
|
|
58725c |
- aDieInfo->stmt_list_offset = bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
- aDieInfo->has_stmt_list = 1;
|
|
|
58725c |
+ if (attr == AT_sibling)
|
|
|
58725c |
+ aDieInfo->sibling = bfd_get_32 (abfd, xptr);
|
|
|
58725c |
+ else if (attr == AT_stmt_list)
|
|
|
58725c |
+ {
|
|
|
58725c |
+ aDieInfo->stmt_list_offset = bfd_get_32 (abfd, xptr);
|
|
|
58725c |
+ aDieInfo->has_stmt_list = 1;
|
|
|
58725c |
+ }
|
|
|
58725c |
}
|
|
|
58725c |
xptr += 4;
|
|
|
58725c |
break;
|
|
|
58725c |
@@ -236,22 +240,41 @@ parse_die (bfd * abfd,
|
|
|
58725c |
xptr += 8;
|
|
|
58725c |
break;
|
|
|
58725c |
case FORM_ADDR:
|
|
|
58725c |
- if (attr == AT_low_pc)
|
|
|
58725c |
- aDieInfo->low_pc = bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
- else if (attr == AT_high_pc)
|
|
|
58725c |
- aDieInfo->high_pc = bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
+ if (xptr + 4 <= aDiePtrEnd)
|
|
|
58725c |
+ {
|
|
|
58725c |
+ if (attr == AT_low_pc)
|
|
|
58725c |
+ aDieInfo->low_pc = bfd_get_32 (abfd, xptr);
|
|
|
58725c |
+ else if (attr == AT_high_pc)
|
|
|
58725c |
+ aDieInfo->high_pc = bfd_get_32 (abfd, xptr);
|
|
|
58725c |
+ }
|
|
|
58725c |
xptr += 4;
|
|
|
58725c |
break;
|
|
|
58725c |
case FORM_BLOCK2:
|
|
|
58725c |
- xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
+ if (xptr + 2 <= aDiePtrEnd)
|
|
|
58725c |
+ {
|
|
|
58725c |
+ block_len = bfd_get_16 (abfd, xptr);
|
|
|
58725c |
+ if (xptr + block_len > aDiePtrEnd
|
|
|
58725c |
+ || xptr + block_len < xptr)
|
|
|
58725c |
+ return FALSE;
|
|
|
58725c |
+ xptr += block_len;
|
|
|
58725c |
+ }
|
|
|
58725c |
+ xptr += 2;
|
|
|
58725c |
break;
|
|
|
58725c |
case FORM_BLOCK4:
|
|
|
58725c |
- xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
58725c |
+ if (xptr + 4 <= aDiePtrEnd)
|
|
|
58725c |
+ {
|
|
|
58725c |
+ block_len = bfd_get_32 (abfd, xptr);
|
|
|
58725c |
+ if (xptr + block_len > aDiePtrEnd
|
|
|
58725c |
+ || xptr + block_len < xptr)
|
|
|
58725c |
+ return FALSE;
|
|
|
58725c |
+ xptr += block_len;
|
|
|
58725c |
+ }
|
|
|
58725c |
+ xptr += 4;
|
|
|
58725c |
break;
|
|
|
58725c |
case FORM_STRING:
|
|
|
58725c |
if (attr == AT_name)
|
|
|
58725c |
aDieInfo->name = (char *) xptr;
|
|
|
58725c |
- xptr += strlen ((char *) xptr) + 1;
|
|
|
58725c |
+ xptr += strnlen ((char *) xptr, aDiePtrEnd - xptr) + 1;
|
|
|
58725c |
break;
|
|
|
58725c |
}
|
|
|
58725c |
}
|