Imported Upstream version 7.9

[platform/upstream/gdb.git] / bfd / elf-attrs.c

diff --git a/bfd/elf-attrs.c b/bfd/elf-attrs.c
index cd0cbca..d06825e 100644 (file)
--- a/bfd/elf-attrs.c
+++ b/bfd/elf-attrs.c
@@ -1,5 +1,5 @@
 /* ELF attributes support (based on ARM EABI attributes).
-   Copyright (C) 2005-2014 Free Software Foundation, Inc.
+   Copyright (C) 2005-2015 Free Software Foundation, Inc.
 
    This file is part of BFD, the Binary File Descriptor library.
 
@@ -430,9 +430,13 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
 {
   bfd_byte *contents;
   bfd_byte *p;
+  bfd_byte *p_end;
   bfd_vma len;
   const char *std_sec;
 
+  /* PR 17512: file: 2844a11d.  */
+  if (hdr->sh_size == 0)
+    return;
   contents = (bfd_byte *) bfd_malloc (hdr->sh_size);
   if (!contents)
     return;
@@ -443,11 +447,14 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
       return;
     }
   p = contents;
+  p_end = p + hdr->sh_size;
   std_sec = get_elf_backend_data (abfd)->obj_attrs_vendor;
+  
   if (*(p++) == 'A')
     {
       len = hdr->sh_size - 1;
-      while (len > 0)
+
+      while (len > 0 && p < p_end - 4)
        {
          unsigned namelen;
          bfd_vma section_len;
@@ -455,6 +462,8 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
 
          section_len = bfd_get_32 (abfd, p);
          p += 4;
+         if (section_len == 0)
+           break;
          if (section_len > len)
            section_len = len;
          len -= section_len;
@@ -475,7 +484,7 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
            }
 
          p += namelen;
-         while (section_len > 0)
+         while (section_len > 0 && p < p_end)
            {
              int tag;
              unsigned int n;
@@ -483,15 +492,23 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
              bfd_vma subsection_len;
              bfd_byte *end;
 
-             tag = read_unsigned_leb128 (abfd, p, &n);
+             tag = safe_read_leb128 (abfd, p, &n, FALSE, p_end);
              p += n;
-             subsection_len = bfd_get_32 (abfd, p);
+             if (p < p_end - 4)
+               subsection_len = bfd_get_32 (abfd, p);
+             else
+               subsection_len = 0;
              p += 4;
+             if (subsection_len == 0)
+               break;
              if (subsection_len > section_len)
                subsection_len = section_len;
              section_len -= subsection_len;
              subsection_len -= n + 4;
              end = p + subsection_len;
+             /* PR 17512: file: 0e8c0c90.  */
+             if (end > p_end)
+               end = p_end;
              switch (tag)
                {
                case Tag_File:
@@ -499,25 +516,25 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
                    {
                      int type;
 
-                     tag = read_unsigned_leb128 (abfd, p, &n);
+                     tag = safe_read_leb128 (abfd, p, &n, FALSE, end);
                      p += n;
                      type = _bfd_elf_obj_attrs_arg_type (abfd, vendor, tag);
                      switch (type & (ATTR_TYPE_FLAG_INT_VAL | ATTR_TYPE_FLAG_STR_VAL))
                        {
                        case ATTR_TYPE_FLAG_INT_VAL | ATTR_TYPE_FLAG_STR_VAL:
-                         val = read_unsigned_leb128 (abfd, p, &n);
+                         val = safe_read_leb128 (abfd, p, &n, FALSE, end);
                          p += n;
                          bfd_elf_add_obj_attr_int_string (abfd, vendor, tag,
-                                                          val, (char *)p);
+                                                          val, (char *) p);
                          p += strlen ((char *)p) + 1;
                          break;
                        case ATTR_TYPE_FLAG_STR_VAL:
                          bfd_elf_add_obj_attr_string (abfd, vendor, tag,
-                                                      (char *)p);
+                                                      (char *) p);
                          p += strlen ((char *)p) + 1;
                          break;
                        case ATTR_TYPE_FLAG_INT_VAL:
-                         val = read_unsigned_leb128 (abfd, p, &n);
+                         val = safe_read_leb128 (abfd, p, &n, FALSE, end);
                          p += n;
                          bfd_elf_add_obj_attr_int (abfd, vendor, tag, val);
                          break;