Update check for invalid values in pe_bfd_read_buildid function.

	PR 22373
	* peicode.h (pe_bfd_read_buildid): Revise check for invalid size
	and offset in light of further possible bogus values.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 662ef44cc6079da0256c42907b91b4dd3c16b222..60fbc9c8e48425243774c8044b206edad29766cc 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2017-11-01  Nick Clifton  <nickc@redhat.com>
+
+       PR 22373
+       * peicode.h (pe_bfd_read_buildid): Revise check for invalid size
+       and offset in light of further possible bogus values.
+
 2017-11-01  Alan Modra  <amodra@gmail.com>
 
        PR 22374

diff --git a/bfd/peicode.h b/bfd/peicode.h
index f3b759cce88d01cf814f529351723a423e546ecd..e5cacbd2c106fbe7fc28340268479f905a9fccab 100644 (file)
--- a/bfd/peicode.h
+++ b/bfd/peicode.h
@@ -1329,9 +1329,8 @@ pe_bfd_read_buildid (bfd *abfd)
   /* PR 20605 and 22373: Make sure that the data is really there.
      Note - since we are dealing with unsigned quantities we have
      to be careful to check for potential overflows.  */
-  if (dataoff > section->size
-      || size > section->size
-      || dataoff + size > section->size)
+  if (dataoff >= section->size
+      || size > section->size - dataoff)
     {
       _bfd_error_handler (_("%B: Error: Debug Data ends beyond end of debug directory."),
                          abfd);