From: Cary Coutant <ccoutant@google.com>
Date: Mon, 9 Jun 2014 21:55:02 +0000 (-0700)
Subject: Add check to keep from segfaulting on a corrupt .debug_pubnames section.
X-Git-Tag: gdb-7.8-release~114
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=9baa787b14d9a92067ecb1731407c5abe37d7c3c;p=external%2Fbinutils.git

Add check to keep from segfaulting on a corrupt .debug_pubnames section.

gold/
	* dwarf_reader.cc (Dwarf_pubnames_table::read_header): Check that
	unit_length is within section bounds.
---

diff --git a/gold/ChangeLog b/gold/ChangeLog
index 59661a0..151fcde 100644
--- a/gold/ChangeLog
+++ b/gold/ChangeLog
@@ -1,5 +1,10 @@
 2014-06-09  Cary Coutant  <ccoutant@google.com>
 
+	* dwarf_reader.cc (Dwarf_pubnames_table::read_header): Check that
+	unit_length is within section bounds.
+
+2014-06-09  Cary Coutant  <ccoutant@google.com>
+
 	PR gold/16980
 	* layout.cc (Layout::print_to_mapfile): Print unattached sections in
 	map.
diff --git a/gold/dwarf_reader.cc b/gold/dwarf_reader.cc
index df14bd5..30aea10 100644
--- a/gold/dwarf_reader.cc
+++ b/gold/dwarf_reader.cc
@@ -580,6 +580,12 @@ Dwarf_pubnames_table::read_header(off_t offset)
     }
   this->end_of_table_ = pinfo + unit_length;
 
+  // If unit_length is too big, maybe we should reject the whole table,
+  // but in cases we know about, it seems OK to assume that the table
+  // is valid through the actual end of the section.
+  if (this->end_of_table_ > this->buffer_end_)
+    this->end_of_table_ = this->buffer_end_;
+
   // Check the version.
   unsigned int version = this->dwinfo_->read_from_pointer<16>(pinfo);
   pinfo += 2;