From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1062) id B10AB3858CDB; Tue, 22 Aug 2023 02:23:33 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B10AB3858CDB Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Alan Modra To: bfd-cvs@sourceware.org Subject: [binutils-gdb] objdump: file name table entry count check X-Act-Checkin: binutils-gdb X-Git-Author: Alan Modra X-Git-Refname: refs/heads/master X-Git-Oldrev: 5bf26ab7cb82c2e6308b269af44b989a51ee7903 X-Git-Newrev: 8032f75b2994816e87e9d2ab7c46ad86601c999b Message-Id: <20230822022333.B10AB3858CDB@sourceware.org> Date: Tue, 22 Aug 2023 02:23:33 +0000 (GMT) X-BeenThere: binutils-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Aug 2023 02:23:33 -0000 https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D8032f75b2994= 816e87e9d2ab7c46ad86601c999b commit 8032f75b2994816e87e9d2ab7c46ad86601c999b Author: Alan Modra Date: Tue Aug 22 11:41:37 2023 +0930 objdump: file name table entry count check =20 Fuzzers have found that objdump -W takes a really long time if the entry count uleb is ridiculously large, and format attributes don't consume data (which doesn't make sense for a table of names). =20 * dwarf.c (display_formatted_table): Sanity check count of table entries. Diff: --- binutils/dwarf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/binutils/dwarf.c b/binutils/dwarf.c index 4f695bf2bca..3ebc45ae373 100644 --- a/binutils/dwarf.c +++ b/binutils/dwarf.c @@ -4313,10 +4313,10 @@ display_formatted_table (unsigned char *data, printf (_("\n The %s is empty.\n"), table_name); return data; } - else if (data >=3D end) + else if (data >=3D end + || data_count > (size_t) (end - data)) { - warn (_("%s: Corrupt entry count - expected %#" PRIx64 - " but none found\n"), table_name, data_count); + warn (_("%s: Corrupt entry count %#" PRIx64 "\n"), table_name, data_= count); return data; }