mirror of
https://git.yoctoproject.org/poky
synced 2026-03-12 02:09:39 +01:00
9e7dc232e7
affects: <= 2.29.1 (From OE-Core rev: 755fd4e68af4cdafc482c02b7822cc06215da4fb) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
From c361faae8d964db951b7100cada4dcdc983df1bf Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Mon, 25 Sep 2017 19:03:46 +0930
|
|
Subject: [PATCH] PR22200, DWARF5 .debug_line sanity check
|
|
|
|
The format_count entry can't be zero unless the count is also zero.
|
|
|
|
PR 22200
|
|
* dwarf2.c (read_formatted_entries): Error on format_count zero.
|
|
|
|
Upstream-Status: Backport
|
|
Affects: <= 2.29.1
|
|
CVE: CVE-2017-15023
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
bfd/ChangeLog | 5 +++++
|
|
bfd/dwarf2.c | 7 +++++++
|
|
2 files changed, 12 insertions(+)
|
|
|
|
Index: git/bfd/dwarf2.c
|
|
===================================================================
|
|
--- git.orig/bfd/dwarf2.c
|
|
+++ git/bfd/dwarf2.c
|
|
@@ -1934,6 +1934,13 @@ read_formatted_entries (struct comp_unit
|
|
data_count = _bfd_safe_read_leb128 (abfd, buf, &bytes_read, FALSE, buf_end);
|
|
buf += bytes_read;
|
|
|
|
+ if (format_count == 0 && data_count != 0)
|
|
+ {
|
|
+ _bfd_error_handler (_("Dwarf Error: Zero format count."));
|
|
+ bfd_set_error (bfd_error_bad_value);
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
/* PR 22210. Paranoia check. Don't bother running the loop
|
|
if we know that we are going to run out of buffer. */
|
|
if (data_count > (bfd_vma) (buf_end - buf))
|
|
Index: git/bfd/ChangeLog
|
|
===================================================================
|
|
--- git.orig/bfd/ChangeLog
|
|
+++ git/bfd/ChangeLog
|
|
@@ -1,4 +1,9 @@
|
|
2017-09-25 Alan Modra <amodra@gmail.com>
|
|
+
|
|
+ PR 22200
|
|
+ * dwarf2.c (read_formatted_entries): Error on format_count zero.
|
|
+
|
|
+2017-09-25 Alan Modra <amodra@gmail.com>
|
|
|
|
PR 22201
|
|
* dwarf2.c (scan_unit_for_symbols): Ignore DW_AT_name unless it
|