espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-20 09:58:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix an infinite loop in the DWARF decoder when parsing a corrupt string table.

Browse Source 
PR 27861
	* dwarf.c (display_debug_str_offsets): Warn if the length field is
	larger than the amount of data remaining in the section.
This commit is contained in:
Nick Clifton
2021-05-13 14:31:09 +01:00
parent b96a1bcb81
commit c4375dd764
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
binutils/ChangeLog
View File

@ -1,3 +1,9 @@
2021-05-13 Nick Clifton <nickc@redhat.com>
PR 27861
* dwarf.c (display_debug_str_offsets): Warn if the length field is
larger than the amount of data remaining in the section.
2021-05-13 Alan Modra <amodra@gmail.com> 2021-05-13 Alan Modra <amodra@gmail.com>
PR 27861 PR 27861

9
binutils/dwarf.c
View File

@ -7509,6 +7509,13 @@ display_debug_str_offsets (struct dwarf_section *section,
printf (_(" Length: %#lx\n"), (unsigned long) length); printf (_(" Length: %#lx\n"), (unsigned long) length);
printf (_(" Version: %#lx\n"), (unsigned long) version); printf (_(" Version: %#lx\n"), (unsigned long) version);
printf (_(" Index Offset [String]\n")); printf (_(" Index Offset [String]\n"));
if (entries_end > end)
{
warn (_("Length value (0x%s) > data remaining in the section (0x%lx)\n"),
dwarf_vmatoa ("x", length), (long)(end - curr));
entries_end = end;
}
} }
for (idx = 0; curr < entries_end; idx++) for (idx = 0; curr < entries_end; idx++)
@ -7520,7 +7527,7 @@ display_debug_str_offsets (struct dwarf_section *section,
/* Not enough space to read one entry_length, give up. */ /* Not enough space to read one entry_length, give up. */
return 0; return 0;
SAFE_BYTE_GET_AND_INC (offset, curr, entry_length, end); SAFE_BYTE_GET_AND_INC (offset, curr, entry_length, entries_end);
if (dwo) if (dwo)
string = (const unsigned char *) string = (const unsigned char *)
fetch_indexed_string (idx, NULL, entry_length, dwo); fetch_indexed_string (idx, NULL, entry_length, dwo);