asan: mips ecoff integer overflow

Alan Modra amodra@gmail.com
Sat Jan 24 00:18:24 GMT 2026


Silence an inconsequential oss-fuzz complaint.

	* ecofflink.c (lookup_line): Make lineno unsigned to avoid
	integer overflow.  Sign extend without a conditional.

diff --git a/bfd/ecofflink.c b/bfd/ecofflink.c
index 8f20454394e..5d3b4f612e1 100644
--- a/bfd/ecofflink.c
+++ b/bfd/ecofflink.c
@@ -2055,7 +2055,7 @@ lookup_line (bfd *abfd,
       PDR pdr;
       unsigned char *line_ptr;
       unsigned char *line_end;
-      int lineno;
+      unsigned int lineno;
       /* This file uses ECOFF debugging information.  Each FDR has a
 	 list of procedure descriptors (PDR).  The address in the FDR
 	 is the absolute address of the first procedure.  The address
@@ -2203,16 +2203,14 @@ lookup_line (bfd *abfd,
 	  int delta;
 	  unsigned int count;
 
-	  delta = *line_ptr >> 4;
-	  if (delta >= 0x8)
-	    delta -= 0x10;
+	  delta = (*line_ptr >> 4) & 0xf;
+	  delta = (delta ^ 8) - 8;
 	  count = (*line_ptr & 0xf) + 1;
 	  ++line_ptr;
 	  if (delta == -8)
 	    {
-	      delta = (((line_ptr[0]) & 0xff) << 8) + ((line_ptr[1]) & 0xff);
-	      if (delta >= 0x8000)
-		delta -= 0x10000;
+	      delta = (((line_ptr[0]) & 0xff) << 8) | ((line_ptr[1]) & 0xff);
+	      delta = (delta ^ 0x8000) - 0x8000;
 	      line_ptr += 2;
 	    }
 	  lineno += delta;
@@ -2273,7 +2271,7 @@ lookup_line (bfd *abfd,
 						 + proc_sym.iss);
 	    }
 	}
-      if (lineno == ilineNil)
+      if (lineno == (unsigned) ilineNil)
 	lineno = 0;
       line_info->cache.line_num = lineno;
     }

-- 
Alan Modra


More information about the Binutils mailing list