[binutils-gdb] ubsan: shift exponent is too large

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7b54caddca1013d10219da097e08d4cd4db6b923

commit 7b54caddca1013d10219da097e08d4cd4db6b923
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Feb 16 19:27:24 2021 +1030

    ubsan: shift exponent is too large
    
            * libbfd.c (_bfd_read_unsigned_leb128): Avoid excessive shift.
            (_bfd_safe_read_leb128, _bfd_read_signed_leb128): Likewise.

Diff:
---
 bfd/ChangeLog |  5 +++++
 bfd/libbfd.c  | 23 +++++++++++++++--------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index e3f87787062..e2e9256086a 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,8 @@
+2021-02-16  Alan Modra  <amodra@gmail.com>
+
+	* libbfd.c (_bfd_read_unsigned_leb128): Avoid excessive shift.
+	(_bfd_safe_read_leb128, _bfd_read_signed_leb128): Likewise.
+
 2021-02-15  Jan Beulich  <jbeulich@suse.com>
 
 	* doc/Makefile.am: Replace "cp -p" by "$(LN_S)".
diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index cd94b81bc43..4f3dd5ad53c 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -1074,8 +1074,11 @@ _bfd_read_unsigned_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, buf);
       buf++;
       num_read++;
-      result |= (((bfd_vma) byte & 0x7f) << shift);
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+	{
+	  result |= (((bfd_vma) byte & 0x7f) << shift);
+	  shift += 7;
+	}
     }
   while (byte & 0x80);
   *bytes_read_ptr = num_read;
@@ -1104,10 +1107,11 @@ _bfd_safe_read_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, data);
       data++;
       num_read++;
-
-      result |= ((bfd_vma) (byte & 0x7f)) << shift;
-
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+	{
+	  result |= ((bfd_vma) (byte & 0x7f)) << shift;
+	  shift += 7;
+	}
       if ((byte & 0x80) == 0)
 	break;
     }
@@ -1141,8 +1145,11 @@ _bfd_read_signed_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, buf);
       buf ++;
       num_read ++;
-      result |= (((bfd_vma) byte & 0x7f) << shift);
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+	{
+	  result |= (((bfd_vma) byte & 0x7f) << shift);
+	  shift += 7;
+	}
     }
   while (byte & 0x80);
   if (shift < 8 * sizeof (result) && (byte & 0x40))