This is the mail archive of the mailing list for the binutils project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[gold commit] Fix segfault when reading corrupt .debug_pubnames table

Sometimes, GCC will produce a .debug_pubnames unit_length field that is
too large, and gold will try to read name entries beyond the end of the
section. This patch adds an extra check to prevent that from happening.


2014-06-09  Cary Coutant  <>

        * (Dwarf_pubnames_table::read_header): Check that
        unit_length is within section bounds.

diff --git a/gold/ b/gold/
index df14bd5..30aea10 100644
--- a/gold/
+++ b/gold/
@@ -580,6 +580,12 @@ Dwarf_pubnames_table::read_header(off_t offset)
   this->end_of_table_ = pinfo + unit_length;

+  // If unit_length is too big, maybe we should reject the whole table,
+  // but in cases we know about, it seems OK to assume that the table
+  // is valid through the actual end of the section.
+  if (this->end_of_table_ > this->buffer_end_)
+    this->end_of_table_ = this->buffer_end_;
   // Check the version.
   unsigned int version = this->dwinfo_->read_from_pointer<16>(pinfo);
   pinfo += 2;

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]