[binutils-gdb] asan: mips ecoff integer overflow

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdad40e8514966229921181b10a4c243f3c1b83d

commit cdad40e8514966229921181b10a4c243f3c1b83d
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Jan 23 18:17:06 2026 +1030

    asan: mips ecoff integer overflow
    
    Silence an inconsequential oss-fuzz complaint.
    
            * ecofflink.c (lookup_line): Make lineno unsigned to avoid
            integer overflow.  Sign extend without a conditional.

Diff:
---
 bfd/ecofflink.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/bfd/ecofflink.c b/bfd/ecofflink.c
index 8f20454394e..5d3b4f612e1 100644
--- a/bfd/ecofflink.c
+++ b/bfd/ecofflink.c
@@ -2055,7 +2055,7 @@ lookup_line (bfd *abfd,
       PDR pdr;
       unsigned char *line_ptr;
       unsigned char *line_end;
-      int lineno;
+      unsigned int lineno;
       /* This file uses ECOFF debugging information.  Each FDR has a
 	 list of procedure descriptors (PDR).  The address in the FDR
 	 is the absolute address of the first procedure.  The address
@@ -2203,16 +2203,14 @@ lookup_line (bfd *abfd,
 	  int delta;
 	  unsigned int count;
 
-	  delta = *line_ptr >> 4;
-	  if (delta >= 0x8)
-	    delta -= 0x10;
+	  delta = (*line_ptr >> 4) & 0xf;
+	  delta = (delta ^ 8) - 8;
 	  count = (*line_ptr & 0xf) + 1;
 	  ++line_ptr;
 	  if (delta == -8)
 	    {
-	      delta = (((line_ptr[0]) & 0xff) << 8) + ((line_ptr[1]) & 0xff);
-	      if (delta >= 0x8000)
-		delta -= 0x10000;
+	      delta = (((line_ptr[0]) & 0xff) << 8) | ((line_ptr[1]) & 0xff);
+	      delta = (delta ^ 0x8000) - 0x8000;
 	      line_ptr += 2;
 	    }
 	  lineno += delta;
@@ -2273,7 +2271,7 @@ lookup_line (bfd *abfd,
 						 + proc_sym.iss);
 	    }
 	}
-      if (lineno == ilineNil)
+      if (lineno == (unsigned) ilineNil)
 	lineno = 0;
       line_info->cache.line_num = lineno;
     }