Blame SOURCES/binutils-CVE-2018-7569.patch

381f6c
--- binutils.orig/bfd/dwarf2.c	2018-05-01 13:04:35.055041935 +0100
381f6c
+++ binutils-2.30/bfd/dwarf2.c	2018-05-01 13:31:32.882624448 +0100
381f6c
@@ -622,14 +622,24 @@ read_8_bytes (bfd *abfd, bfd_byte *buf,
381f6c
 }
381f6c
 
381f6c
 static bfd_byte *
381f6c
-read_n_bytes (bfd *abfd ATTRIBUTE_UNUSED,
381f6c
-	      bfd_byte *buf,
381f6c
-	      bfd_byte *end,
381f6c
-	      unsigned int size ATTRIBUTE_UNUSED)
381f6c
-{
381f6c
-  if (buf + size > end)
381f6c
-    return NULL;
381f6c
-  return buf;
381f6c
+read_n_bytes (bfd_byte *           buf,
381f6c
+	      bfd_byte *           end,
381f6c
+	      struct dwarf_block * block)
381f6c
+{
381f6c
+  unsigned int  size = block->size;
381f6c
+  bfd_byte *    block_end = buf + size;
381f6c
+
381f6c
+  if (block_end > end || block_end < buf)
381f6c
+    {
381f6c
+      block->data = NULL;
381f6c
+      block->size = 0;
381f6c
+      return end;
381f6c
+    }
381f6c
+  else
381f6c
+    {
381f6c
+      block->data = buf;
381f6c
+      return block_end;
381f6c
+    }
381f6c
 }
381f6c
 
381f6c
 /* Scans a NUL terminated string starting at BUF, returning a pointer to it.
381f6c
@@ -1127,8 +1137,7 @@ read_attribute_value (struct attribute *
381f6c
 	return NULL;
381f6c
       blk->size = read_2_bytes (abfd, info_ptr, info_ptr_end);
381f6c
       info_ptr += 2;
381f6c
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
381f6c
-      info_ptr += blk->size;
381f6c
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
381f6c
       attr->u.blk = blk;
381f6c
       break;
381f6c
     case DW_FORM_block4:
381f6c
@@ -1138,8 +1147,7 @@ read_attribute_value (struct attribute *
381f6c
 	return NULL;
381f6c
       blk->size = read_4_bytes (abfd, info_ptr, info_ptr_end);
381f6c
       info_ptr += 4;
381f6c
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
381f6c
-      info_ptr += blk->size;
381f6c
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
381f6c
       attr->u.blk = blk;
381f6c
       break;
381f6c
     case DW_FORM_data2:
381f6c
@@ -1179,8 +1187,7 @@ read_attribute_value (struct attribute *
381f6c
       blk->size = _bfd_safe_read_leb128 (abfd, info_ptr, &bytes_read,
381f6c
 					 FALSE, info_ptr_end);
381f6c
       info_ptr += bytes_read;
381f6c
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
381f6c
-      info_ptr += blk->size;
381f6c
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
381f6c
       attr->u.blk = blk;
381f6c
       break;
381f6c
     case DW_FORM_block1:
381f6c
@@ -1190,8 +1197,7 @@ read_attribute_value (struct attribute *
381f6c
 	return NULL;
381f6c
       blk->size = read_1_byte (abfd, info_ptr, info_ptr_end);
381f6c
       info_ptr += 1;
381f6c
-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
381f6c
-      info_ptr += blk->size;
381f6c
+      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
381f6c
       attr->u.blk = blk;
381f6c
       break;
381f6c
     case DW_FORM_data1: