Blame SOURCES/binutils-CVE-2018-10372.patch

381f6c
--- binutils.orig/binutils/dwarf.c	2018-05-01 11:42:02.656431736 +0100
381f6c
+++ binutils-2.30/binutils/dwarf.c	2018-05-01 11:43:24.210383020 +0100
381f6c
@@ -9244,7 +9244,18 @@ process_cu_tu_index (struct dwarf_sectio
381f6c
 		}
381f6c
 
381f6c
 	      if (!do_display)
381f6c
-		memcpy (&this_set[row - 1].signature, ph, sizeof (uint64_t));
381f6c
+		{
381f6c
+		  size_t num_copy = sizeof (uint64_t);
381f6c
+
381f6c
+		  /* PR 23064: Beware of buffer overflow.  */
381f6c
+		  if (ph + num_copy < limit)
381f6c
+		    memcpy (&this_set[row - 1].signature, ph, num_copy);
381f6c
+		  else
381f6c
+		    {
381f6c
+		      warn (_("Signature (%p) extends beyond end of space in section\n"), ph);
381f6c
+		      return 0;
381f6c
+		    }
381f6c
+		}
381f6c
 
381f6c
 	      prow = poffsets + (row - 1) * ncols * 4;
381f6c
 	      /* PR 17531: file: b8ce60a8.  */