Blame SOURCES/binutils-CVE-2018-7569.patch

6cffa7
--- binutils.orig/bfd/dwarf2.c	2018-05-15 17:25:27.661131255 +0100
6cffa7
+++ binutils-2.27/bfd/dwarf2.c	2018-05-15 17:38:16.900598281 +0100
6cffa7
@@ -606,14 +606,24 @@ read_8_bytes (bfd *abfd, bfd_byte *buf,
6cffa7
 }
6cffa7
 
6cffa7
 static bfd_byte *
6cffa7
-read_n_bytes (bfd *abfd ATTRIBUTE_UNUSED,
6cffa7
-	      bfd_byte *buf,
6cffa7
-	      bfd_byte *end,
6cffa7
-	      unsigned int size ATTRIBUTE_UNUSED)
6cffa7
+read_n_bytes (bfd_byte *           buf,
6cffa7
+	      bfd_byte *           end,
6cffa7
+	      struct dwarf_block * block)
6cffa7
 {
6cffa7
-  if (buf + size > end)
6cffa7
-    return NULL;
6cffa7
-  return buf;
6cffa7
+  unsigned int  size = block->size;
6cffa7
+  bfd_byte *    block_end = buf + size;
6cffa7
+
6cffa7
+  if (block_end > end || block_end < buf)
6cffa7
+    {
6cffa7
+      block->data = NULL;
6cffa7
+      block->size = 0;
6cffa7
+      return end;
6cffa7
+    }
6cffa7
+  else
6cffa7
+    {
6cffa7
+      block->data = buf;
6cffa7
+      return block_end;
6cffa7
+    }
6cffa7
 }
6cffa7
 
6cffa7
 /* Scans a NUL terminated string starting at BUF, returning a pointer to it.
6cffa7
@@ -1053,8 +1063,7 @@ read_attribute_value (struct attribute *
6cffa7
 	return NULL;
6cffa7
       blk->size = read_2_bytes (abfd, info_ptr, info_ptr_end);
6cffa7
       info_ptr += 2;
6cffa7
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
6cffa7
-      info_ptr += blk->size;
6cffa7
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
6cffa7
       attr->u.blk = blk;
6cffa7
       break;
6cffa7
     case DW_FORM_block4:
6cffa7
@@ -1064,8 +1073,7 @@ read_attribute_value (struct attribute *
6cffa7
 	return NULL;
6cffa7
       blk->size = read_4_bytes (abfd, info_ptr, info_ptr_end);
6cffa7
       info_ptr += 4;
6cffa7
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
6cffa7
-      info_ptr += blk->size;
6cffa7
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
6cffa7
       attr->u.blk = blk;
6cffa7
       break;
6cffa7
     case DW_FORM_data2:
6cffa7
@@ -1100,8 +1108,7 @@ read_attribute_value (struct attribute *
6cffa7
 	return NULL;
6cffa7
       blk->size = safe_read_leb128 (abfd, info_ptr, &bytes_read, FALSE, info_ptr_end);
6cffa7
       info_ptr += bytes_read;
6cffa7
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
6cffa7
-      info_ptr += blk->size;
6cffa7
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
6cffa7
       attr->u.blk = blk;
6cffa7
       break;
6cffa7
     case DW_FORM_block1:
6cffa7
@@ -1111,8 +1118,7 @@ read_attribute_value (struct attribute *
6cffa7
 	return NULL;
6cffa7
       blk->size = read_1_byte (abfd, info_ptr, info_ptr_end);
6cffa7
       info_ptr += 1;
6cffa7
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
6cffa7
-      info_ptr += blk->size;
6cffa7
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
6cffa7
       attr->u.blk = blk;
6cffa7
       break;
6cffa7
     case DW_FORM_data1: