PR27836, readelf -w pointer comparison UB

[Alan Modra]

	PR 27836
	* dwarf.c (display_debug_frames): Don't compare pointers derived
	from user input.  Test offset against bounds instead.

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 896035ccde2..51c0afc275e 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -8810,16 +8810,18 @@ display_debug_frames (struct dwarf_section *section,
 	{
 	  unsigned char *look_for;
 	  unsigned long segment_selector;
+	  dwarf_vma cie_off;
 
+	  cie_off = cie_id;
 	  if (is_eh)
 	    {
 	      dwarf_vma sign = (dwarf_vma) 1 << (offset_size * 8 - 1);
-	      look_for = start - 4 - ((cie_id ^ sign) - sign);
+	      cie_off = (cie_off ^ sign) - sign;
+	      cie_off = start - 4 - section_start - cie_off;
 	    }
-	  else
-	    look_for = section_start + cie_id;
 
-	  if (look_for <= saved_start)
+	  look_for = section_start + cie_off;
+	  if (cie_off <= (dwarf_vma) (saved_start - section_start))
 	    {
 	      for (cie = chunks; cie ; cie = cie->next)
 		if (cie->chunk_start == look_for)

-- 
Alan Modra
Australia Development Lab, IBM