We tried to read the rnglists header length and only then checked if
there were any bytes left. Make sure to check there are at least 4
bytes for the initial unit length.
* libdw/libdwP.h (__libdw_cu_ranges_base): Check before initial
unit_length read.
https://sourceware.org/bugzilla/show_bug.cgi?id=34385
Reported-by: Karan Kurani <[email protected]>
Signed-off-by: Mark Wielaard <[email protected]>
---
libdw/libdwP.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libdw/libdwP.h b/libdw/libdwP.h
index 5e1029bd2ac2..25391396ff6b 100644
--- a/libdw/libdwP.h
+++ b/libdw/libdwP.h
@@ -1373,6 +1373,8 @@ __libdw_cu_ranges_base (Dwarf_CU *cu)
const unsigned char *const dataend
= (unsigned char *) data->d_buf + data->d_size;
+ if (unlikely (readp > dataend - 4))
+ goto no_header;
uint64_t unit_length = read_4ubyte_unaligned_inc (dbg, readp);
unsigned int offset_size = 4;
if (unlikely (unit_length == 0xffffffff))
--
2.55.0
