/* DWARF 1 find nearest line (_bfd_dwarf1_find_nearest_line).
- Copyright (C) 1998-2016 Free Software Foundation, Inc.
+ Copyright (C) 1998-2019 Free Software Foundation, Inc.
Written by Gavin Romig-Koch of Cygnus Solutions (gavin@cygnus.com).
Return FALSE if the die is invalidly formatted; TRUE otherwise. */
static bfd_boolean
-parse_die (bfd * abfd,
+parse_die (bfd * abfd,
struct die_info * aDieInfo,
- bfd_byte * aDiePtr,
- bfd_byte * aDiePtrEnd)
+ bfd_byte * aDiePtr,
+ bfd_byte * aDiePtrEnd)
{
bfd_byte *this_die = aDiePtr;
bfd_byte *xptr = this_die;
memset (aDieInfo, 0, sizeof (* aDieInfo));
/* First comes the length. */
- aDieInfo->length = bfd_get_32 (abfd, (bfd_byte *) xptr);
+ if (xptr + 4 > aDiePtrEnd)
+ return FALSE;
+ aDieInfo->length = bfd_get_32 (abfd, xptr);
xptr += 4;
if (aDieInfo->length == 0
- || (this_die + aDieInfo->length) >= aDiePtrEnd)
+ || this_die + aDieInfo->length > aDiePtrEnd)
return FALSE;
+ aDiePtrEnd = this_die + aDieInfo->length;
if (aDieInfo->length < 6)
{
/* Just padding bytes. */
}
/* Then the tag. */
- aDieInfo->tag = bfd_get_16 (abfd, (bfd_byte *) xptr);
+ if (xptr + 2 > aDiePtrEnd)
+ return FALSE;
+ aDieInfo->tag = bfd_get_16 (abfd, xptr);
xptr += 2;
/* Then the attributes. */
- while (xptr < (this_die + aDieInfo->length))
+ while (xptr + 2 <= aDiePtrEnd)
{
+ unsigned int block_len;
unsigned short attr;
/* Parse the attribute based on its form. This section
- must handle all dwarf1 forms, but need only handle the
+ must handle all dwarf1 forms, but need only handle the
actual attributes that we care about. */
- attr = bfd_get_16 (abfd, (bfd_byte *) xptr);
+ attr = bfd_get_16 (abfd, xptr);
xptr += 2;
switch (FORM_FROM_ATTR (attr))
break;
case FORM_DATA4:
case FORM_REF:
- if (attr == AT_sibling)
- aDieInfo->sibling = bfd_get_32 (abfd, (bfd_byte *) xptr);
- else if (attr == AT_stmt_list)
+ if (xptr + 4 <= aDiePtrEnd)
{
- aDieInfo->stmt_list_offset = bfd_get_32 (abfd, (bfd_byte *) xptr);
- aDieInfo->has_stmt_list = 1;
+ if (attr == AT_sibling)
+ aDieInfo->sibling = bfd_get_32 (abfd, xptr);
+ else if (attr == AT_stmt_list)
+ {
+ aDieInfo->stmt_list_offset = bfd_get_32 (abfd, xptr);
+ aDieInfo->has_stmt_list = 1;
+ }
}
xptr += 4;
break;
xptr += 8;
break;
case FORM_ADDR:
- if (attr == AT_low_pc)
- aDieInfo->low_pc = bfd_get_32 (abfd, (bfd_byte *) xptr);
- else if (attr == AT_high_pc)
- aDieInfo->high_pc = bfd_get_32 (abfd, (bfd_byte *) xptr);
+ if (xptr + 4 <= aDiePtrEnd)
+ {
+ if (attr == AT_low_pc)
+ aDieInfo->low_pc = bfd_get_32 (abfd, xptr);
+ else if (attr == AT_high_pc)
+ aDieInfo->high_pc = bfd_get_32 (abfd, xptr);
+ }
xptr += 4;
break;
case FORM_BLOCK2:
- xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr);
+ if (xptr + 2 <= aDiePtrEnd)
+ {
+ block_len = bfd_get_16 (abfd, xptr);
+ if (xptr + block_len > aDiePtrEnd
+ || xptr + block_len < xptr)
+ return FALSE;
+ xptr += block_len;
+ }
+ xptr += 2;
break;
case FORM_BLOCK4:
- xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr);
+ if (xptr + 4 <= aDiePtrEnd)
+ {
+ block_len = bfd_get_32 (abfd, xptr);
+ if (xptr + block_len > aDiePtrEnd
+ || xptr + block_len < xptr)
+ return FALSE;
+ xptr += block_len;
+ }
+ xptr += 4;
break;
case FORM_STRING:
if (attr == AT_name)
aDieInfo->name = (char *) xptr;
- xptr += strlen ((char *) xptr) + 1;
+ xptr += strnlen ((char *) xptr, aDiePtrEnd - xptr) + 1;
break;
}
}
}
xptr = stash->line_section + aUnit->stmt_list_offset;
- if (xptr < stash->line_section_end)
+ if (xptr + 8 <= stash->line_section_end)
{
unsigned long eachLine;
bfd_byte *tblend;
/* Allocate an array for the entries. */
amt = sizeof (struct linenumber) * aUnit->line_count;
aUnit->linenumber_table = (struct linenumber *) bfd_alloc (stash->abfd,
- amt);
+ amt);
if (!aUnit->linenumber_table)
return FALSE;
for (eachLine = 0; eachLine < aUnit->line_count; eachLine++)
{
+ if (xptr + 10 > stash->line_section_end)
+ {
+ aUnit->line_count = eachLine;
+ break;
+ }
/* A line number. */
aUnit->linenumber_table[eachLine].linenumber
= bfd_get_32 (stash->abfd, (bfd_byte *) xptr);
if (aUnit->first_child)
for (eachDie = aUnit->first_child;
- eachDie < stash->debug_section_end;
+ eachDie < stash->debug_section_end;
)
{
struct die_info eachDieInfo;
not it's sibling. */
if (aDieInfo.sibling
&& stash->currentDie + aDieInfo.length
- < stash->debug_section_end
+ < stash->debug_section_end
&& stash->currentDie + aDieInfo.length
- != stash->debug_section + aDieInfo.sibling)
+ != stash->debug_section + aDieInfo.sibling)
aUnit->first_child = stash->currentDie + aDieInfo.length;
else
aUnit->first_child = 0;