readelf: ubsan unsigned offset overflow

[Alan Modra]

	PR 33897
	* dwarf.c (display_debug_frames): Don't calculate "look_for"
	until we have checked that cie_off is valid.

(-w diff shown)

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 3c2ba3099fb..3be02345afb 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -10952,7 +10952,6 @@ display_debug_frames (struct dwarf_section *section,
 	}
       else
 	{
-	  unsigned char *look_for;
 	  unsigned long segment_selector;
 	  uint64_t cie_off;
 
@@ -10964,15 +10963,17 @@ display_debug_frames (struct dwarf_section *section,
 	      cie_off = start - 4 - section_start - cie_off;
 	    }
 
-	  look_for = section_start + cie_off;
+	  if (cie_off >= section->size)
+	    cie = NULL;
+	  else
+	    {
+	      unsigned char *look_for = section_start + cie_off;
 	      if (cie_off <= (size_t) (saved_start - section_start))
 		{
 		  for (cie = chunks; cie ; cie = cie->next)
 		    if (cie->chunk_start == look_for)
 		      break;
 		}
-	  else if (cie_off >= section->size)
-	    cie = NULL;
 	      else
 		{
 		  for (cie = forward_refs; cie ; cie = cie->next)
@@ -11007,7 +11008,8 @@ display_debug_frames (struct dwarf_section *section,
 			      unsigned int mreg;
 
 			      read_cie (cie_scan, cie_end, &cie, &version,
-				    &augmentation_data_len, &augmentation_data);
+					&augmentation_data_len,
+					&augmentation_data);
 			      /* PR 17512: file: 3450-2098-0.004.  */
 			      if (cie == NULL)
 				{
@@ -11032,6 +11034,7 @@ display_debug_frames (struct dwarf_section *section,
 			}
 		    }
 		}
+	    }
 
 	  fc = &fde_fc;
 	  memset (fc, 0, sizeof (Frame_Chunk));

-- 
Alan Modra