Blame binutils-CVE-2018-7568.patch
|
 |
0e219f4 |
--- binutils.orig/bfd/dwarf1.c 2018-07-11 11:45:09.482030157 +0100
|
|
|
0e219f4 |
+++ binutils-2.29/bfd/dwarf1.c 2018-07-11 11:48:19.564980423 +0100
|
|
|
0e219f4 |
@@ -208,6 +208,7 @@ parse_die (bfd * abfd,
|
|
|
0e219f4 |
/* Then the attributes. */
|
|
|
0e219f4 |
while (xptr < (this_die + aDieInfo->length))
|
|
|
0e219f4 |
{
|
|
|
0e219f4 |
+ unsigned int block_len;
|
|
|
0e219f4 |
unsigned short attr;
|
|
|
0e219f4 |
|
|
|
0e219f4 |
/* Parse the attribute based on its form. This section
|
|
|
0e219f4 |
@@ -243,10 +244,26 @@ parse_die (bfd * abfd,
|
|
|
0e219f4 |
xptr += 4;
|
|
|
0e219f4 |
break;
|
|
|
0e219f4 |
case FORM_BLOCK2:
|
|
|
0e219f4 |
- xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr);
|
|
|
0e219f4 |
+ if (xptr + 2 <= aDiePtrEnd)
|
|
|
0e219f4 |
+ {
|
|
|
0e219f4 |
+ block_len = bfd_get_16 (abfd, xptr);
|
|
|
0e219f4 |
+ if (xptr + block_len > aDiePtrEnd
|
|
|
0e219f4 |
+ || xptr + block_len < xptr)
|
|
|
0e219f4 |
+ return FALSE;
|
|
|
0e219f4 |
+ xptr += block_len;
|
|
|
0e219f4 |
+ }
|
|
|
0e219f4 |
+ xptr += 2;
|
|
|
0e219f4 |
break;
|
|
|
0e219f4 |
case FORM_BLOCK4:
|
|
|
0e219f4 |
- xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr);
|
|
|
0e219f4 |
+ if (xptr + 4 <= aDiePtrEnd)
|
|
|
0e219f4 |
+ {
|
|
|
0e219f4 |
+ block_len = bfd_get_32 (abfd, xptr);
|
|
|
0e219f4 |
+ if (xptr + block_len > aDiePtrEnd
|
|
|
0e219f4 |
+ || xptr + block_len < xptr)
|
|
|
0e219f4 |
+ return FALSE;
|
|
|
0e219f4 |
+ xptr += block_len;
|
|
|
0e219f4 |
+ }
|
|
|
0e219f4 |
+ xptr += 4;
|
|
|
0e219f4 |
break;
|
|
|
0e219f4 |
case FORM_STRING:
|
|
|
0e219f4 |
if (attr == AT_name)
|