From eef104664efb52965d85a28bc3fc7c77e52e48e2 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Wed, 28 Feb 2018 10:13:54 +0000
Subject: [PATCH] Fix potential integer overflow when reading corrupt dwarf1
 debug information.

	PR 22894
	* dwarf1.c (parse_die): Check the length of form blocks before
	advancing the data pointer.

Upstream-Status: Backport
Affects: Binutils <= 2.30
CVE: CVE-2018-7568
Signed-off-by: Armin Kuster <akuster@mvista.com>

---
 bfd/ChangeLog |  6 ++++++
 bfd/dwarf1.c  | 17 +++++++++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

Index: git/bfd/dwarf1.c
===================================================================
--- git.orig/bfd/dwarf1.c
+++ git/bfd/dwarf1.c
@@ -213,6 +213,7 @@ parse_die (bfd *	     abfd,
   /* Then the attributes.  */
   while (xptr + 2 <= aDiePtrEnd)
     {
+      unsigned int   block_len;
       unsigned short attr;
 
       /* Parse the attribute based on its form.  This section
@@ -255,12 +256,24 @@ parse_die (bfd *	     abfd,
 	  break;
 	case FORM_BLOCK2:
 	  if (xptr + 2 <= aDiePtrEnd)
-	    xptr += bfd_get_16 (abfd, xptr);
+	    {
+	      block_len = bfd_get_16 (abfd, xptr);
+	      if (xptr + block_len > aDiePtrEnd
+		  || xptr + block_len < xptr)
+		return FALSE;
+	      xptr += block_len;
+	    }
 	  xptr += 2;
 	  break;
 	case FORM_BLOCK4:
 	  if (xptr + 4 <= aDiePtrEnd)
-	    xptr += bfd_get_32 (abfd, xptr);
+	    {
+	      block_len = bfd_get_32 (abfd, xptr);
+	      if (xptr + block_len > aDiePtrEnd
+		  || xptr + block_len < xptr)
+		return FALSE;
+	      xptr += block_len;
+	    }
 	  xptr += 4;
 	  break;
 	case FORM_STRING:
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -4,7 +4,11 @@
        * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
        range before converting to a symbol table pointer.
 
-2018-02-28  Alan Modra  <amodra@gmail.com>
+2018-02-28  Nick Clifton  <nickc@redhat.com>
+
+       PR 22894
+       * dwarf1.c (parse_die): Check the length of form blocks before
+       advancing the data pointer.
 
        PR 22895
        PR 22893
@@ -14,6 +18,8 @@
        size is invalid.
        (read_attribute_value): Adjust invocations of read_n_bytes.
 
+2018-02-28  Alan Modra  <amodra@gmail.com>
+
        PR 22887
        * aoutx.h (swap_std_reloc_in): Correct r_index bound check.