Hi Matej,
On Wed, 2026-09-09 at 22:13 +0200, Matej Smycka wrote:
> Commit 6c801dd7 ("libdw: Only read CIE augmentation data if it is
> there", bug 34387) made intern_new_cie only read the 'L'/'R'/'P'
> encoding bytes for a sized ('z') augmentation. Those reads are still
> driven purely by the augmentation-string characters and are not bounded
> by the recorded augmentation_data_size: an augmentation string that
> names more encoding bytes than the CIE's augmentation data actually
> contains makes "*data++" read beyond info->augmentation_data +
> info->augmentation_data_size.
>
> Record the end of the augmentation data and reject the CIE with
> DWARF_E_INVALID_DWARF before each read that would go past it, so the
> augmentation-string parsing can never read outside the declared
> augmentation data. This is the intern_new_cie counterpart to the limit
> check dwarf_next_cfi already applies, as suggested on the list.
>
> Signed-off-by: Matej Smycka <[email protected]>
> ---
>
> Hi Mark,
>
> You're right, my patch predated 6c801dd7, sorry for it.
> Sending the rebased patch below.
Looks good and is I think obviously correct.
Thanks for finding and fixing this.
Pushed as https://sourceware.org/cgit/elfutils/commit/?id=737498605028
Thanks,
Mark
