[binutils-gdb] Prevent illegal memory accesses triggerd by intger overflow when parsing corrupt DWARF information o

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d11ae95ea3403559f052903ab053f43ad7821e37

commit d11ae95ea3403559f052903ab053f43ad7821e37
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu Mar 1 16:14:08 2018 +0000

    Prevent illegal memory accesses triggerd by intger overflow when parsing corrupt DWARF information on a 32-bit host.
    
    	PR 22905
    	* dwarf.c (display_debug_ranges): Check that the offset loaded
    	from the range_entry structure is valid.

Diff:
---
 binutils/ChangeLog |  6 ++++++
 binutils/dwarf.c   | 15 +++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index d9db858..067dd95 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2018-03-01  Nick Clifton  <nickc@redhat.com>
+
+	PR 22905
+	* dwarf.c (display_debug_ranges): Check that the offset loaded
+	from the range_entry structure is valid.
+
 2018-03-01  Alan Modra  <amodra@gmail.com>
 
 	* configure.ac (ALL_LINGUAS): Add sr.  Sort.
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 6aca9b7..17896e6 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -387,6 +387,9 @@ read_uleb128 (unsigned char * data,
     }								\
   while (0)
 
+/* Read AMOUNT bytes from PTR and store them in VAL as an unsigned value.
+   Checks to make sure that the read will not reach or pass END
+   and that VAL is big enough to hold AMOUNT bytes.  */
 #define SAFE_BYTE_GET(VAL, PTR, AMOUNT, END)	\
   do						\
     {						\
@@ -415,6 +418,7 @@ read_uleb128 (unsigned char * data,
     }						\
   while (0)
 
+/* Like SAFE_BYTE_GET, but also increments PTR by AMOUNT.  */
 #define SAFE_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END)	\
   do							\
     {							\
@@ -423,6 +427,7 @@ read_uleb128 (unsigned char * data,
     }							\
   while (0)
 
+/* Like SAFE_BYTE_GET, but reads a signed value.  */
 #define SAFE_SIGNED_BYTE_GET(VAL, PTR, AMOUNT, END)	\
   do							\
     {							\
@@ -441,6 +446,7 @@ read_uleb128 (unsigned char * data,
     }							\
   while (0)
 
+/* Like SAFE_SIGNED_BYTE_GET, but also increments PTR by AMOUNT.  */
 #define SAFE_SIGNED_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END)	\
   do								\
     {								\
@@ -6543,6 +6549,7 @@ display_debug_ranges_list (unsigned char *start, unsigned char *finish,
 	break;
       SAFE_SIGNED_BYTE_GET_AND_INC (end, start, pointer_size, finish);
 
+      
       printf ("    %8.8lx ", offset);
 
       if (begin == 0 && end == 0)
@@ -6810,6 +6817,13 @@ display_debug_ranges (struct dwarf_section *section,
 	  continue;
 	}
 
+      if (next < section_begin || next >= finish)
+	{
+	  warn (_("Corrupt offset (%#8.8lx) in range entry %u\n"),
+		(unsigned long) offset, i);
+	  continue;
+	}
+
       if (dwarf_check != 0 && i > 0)
 	{
 	  if (start < next)
@@ -6825,6 +6839,7 @@ display_debug_ranges (struct dwarf_section *section,
 		    (unsigned long) (next - section_begin), section->name);
 	    }
 	}
+
       start = next;
       last_start = next;