[PATCH] libdwfl: Bounds check Dwarf_Fileinfo file number in dwfl_lineinfo.

[Mark Wielaard <mjw@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1491 bytes --]

https://bugzilla.redhat.com/show_bug.cgi?id=1170810#c30

Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
 libdwfl/ChangeLog       | 4 ++++
 libdwfl/dwfl_lineinfo.c | 8 +++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog
index b915f44..6945eec 100644
--- a/libdwfl/ChangeLog
+++ b/libdwfl/ChangeLog
@@ -1,3 +1,7 @@
+2015-05-05  Mark Wielaard  <mjw@redhat.com>
+
+	* dwfl_lineinfo.c (dwfl_lineinfo): Check info->file is valid.
+
 2015-04-21  Mark Wielaard  <mjw@redhat.com>
 
 	* dwfl_error.c (msgstr): Define as const char *.
diff --git a/libdwfl/dwfl_lineinfo.c b/libdwfl/dwfl_lineinfo.c
index dfb27d8..7ddbfb0 100644
--- a/libdwfl/dwfl_lineinfo.c
+++ b/libdwfl/dwfl_lineinfo.c
@@ -1,5 +1,5 @@
 /* Get information from a source line record returned by libdwfl.
-   Copyright (C) 2005-2010 Red Hat, Inc.
+   Copyright (C) 2005-2010, 2015 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -46,6 +46,12 @@ dwfl_lineinfo (Dwfl_Line *line, Dwarf_Addr *addr, int *linep, int *colp,
   if (colp != NULL)
     *colp = info->column;
 
+  if (unlikely (info->file >= info->files->nfiles))
+    {
+      __libdwfl_seterrno (DWFL_E (LIBDW, DWARF_E_INVALID_DWARF));
+      return NULL;
+    }
+
   struct Dwarf_Fileinfo_s *file = &info->files->info[info->file];
   if (mtime != NULL)
     *mtime = file->mtime;
-- 
2.1.0