- Check for string pointer being outside of the string table.

dlls/dbghelp/stabs.c

@@ -1094,6 +1094,7 @@ BOOL stabs_parse(struct module* module, const char* addr,
     unsigned int                stabbufflen;
     const struct stab_nlist*    stab_ptr;
     const char*                 strs;
+    const char*                 strs_end;
     int                         strtabinc;
     char                        symname[4096];
     unsigned                    incl[32];
@@ -1107,6 +1108,7 @@ BOOL stabs_parse(struct module* module, const char* addr,
     nstab = stablen / sizeof(struct stab_nlist);
     stab_ptr = (const struct stab_nlist*)(addr + staboff);
     strs = (const char*)(addr + strtaboff);
+    strs_end = strs + strtablen;
 
     memset(srcpath, 0, sizeof(srcpath));
     memset(stabs_basic, 0, sizeof(stabs_basic));
@@ -1123,6 +1125,11 @@ BOOL stabs_parse(struct module* module, const char* addr,
     for (i = 0; i < nstab; i++, stab_ptr++)
     {
         ptr = strs + stab_ptr->n_un.n_strx;
+        if ((ptr > strs_end) || (ptr + strlen(ptr) > strs_end))
+        {
+            WARN("Bad stabs string %p\n", ptr);
+            continue;
+        }
         if (ptr[strlen(ptr) - 1] == '\\')
         {
             /*
@@ -1145,6 +1152,15 @@ BOOL stabs_parse(struct module* module, const char* addr,
             ptr = stabbuff;
         }
 
+        /* only symbol entries contain a typedef */
+        switch (stab_ptr->n_type)
+        {
+        case N_GSYM:
+        case N_LCSYM:
+        case N_STSYM:
+        case N_RSYM:
+        case N_LSYM:
+        case N_ROSYM:
             if (strchr(ptr, '=') != NULL)
             {
                 /*
@@ -1164,6 +1180,7 @@ BOOL stabs_parse(struct module* module, const char* addr,
                     continue;
                 }
             }
+        }
 
 #if 0
         const char* defs[] = {"","","","",                      /* 00 */