[binutils-gdb] buffer overflow in parse_stab_array_type

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c2f6391861d9bec3a983cc80f48e2777e582504

commit 6c2f6391861d9bec3a983cc80f48e2777e582504
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Jun 1 10:35:02 2026 +0930

    buffer overflow in parse_stab_array_type
    
    Fix oss-fuzz induced damage.
    
            stabs.c (parse_stab_type): Don't access beyond end of stab
            with bad type.
            (parse_stab_array_type): Don't duplicate "bad stab" message.

Diff:
---
 binutils/stabs.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/binutils/stabs.c b/binutils/stabs.c
index 81068a4bf7c..27d49376b97 100644
--- a/binutils/stabs.c
+++ b/binutils/stabs.c
@@ -1293,6 +1293,12 @@ parse_stab_type (void *                dhandle,
 	}
     }
 
+  if (*pp >= p_end)
+    {
+      bad_stab (orig);
+      return DEBUG_TYPE_NULL;
+    }
+
   descriptor = **pp;
   ++*pp;
 
@@ -3219,11 +3225,7 @@ parse_stab_array_type (void *dhandle,
     {
       index_type = debug_find_named_type (dhandle, "int");
       if (index_type == DEBUG_TYPE_NULL)
-	{
-	  index_type = debug_make_int_type (dhandle, 4, false);
-	  if (index_type == DEBUG_TYPE_NULL)
-	    return DEBUG_TYPE_NULL;
-	}
+	index_type = debug_make_int_type (dhandle, 4, false);
       *pp = p;
     }
   else
@@ -3231,6 +3233,8 @@ parse_stab_array_type (void *dhandle,
       index_type = parse_stab_type (dhandle, info, (const char *) NULL, pp,
 				    (debug_type **) NULL, p_end);
     }
+  if (index_type == DEBUG_TYPE_NULL)
+    return DEBUG_TYPE_NULL;
 
   if (**pp != ';')
     {