[COMMITTED] readelf: Sanity check CIE unit_length and augmentationlen in debug_frame.

[COMMITTED] readelf: Sanity check CIE unit_length and augmentationlen in debug_frame.

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 2058 bytes --]

Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
 src/ChangeLog |  5 +++++
 src/readelf.c | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/ChangeLog b/src/ChangeLog
index be1d55f..7561041 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
 2014-11-14  Mark Wielaard  <mjw@redhat.com>
 
+	* readelf.c (print_debug_frame_section): Sanity Check CIE
+	unit_length and augmentationlen.
+
+2014-11-14  Mark Wielaard  <mjw@redhat.com>
+
 	* readelf.c (handle_versym): Check def == NULL before use.
 
 2014-11-08  Mark Wielaard  <mjw@redhat.com>
diff --git a/src/readelf.c b/src/readelf.c
index 243e16e..065ee1c 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5332,6 +5332,10 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
 	  continue;
 	}
 
+      Dwarf_Word maxsize = dataend - readp;
+      if (unlikely (unit_length > maxsize))
+	goto invalid_data;
+
       unsigned int ptr_size = ehdr->e_ident[EI_CLASS] == ELFCLASS32 ? 4 : 8;
 
       ptrdiff_t start = readp - (unsigned char *) data->d_buf;
@@ -5413,7 +5417,11 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
 	      get_uleb128 (augmentationlen, readp);
 
 	      if (augmentationlen > (size_t) (dataend - readp))
-		error (1, 0, gettext ("invalid augmentation length"));
+		{
+		  error (0, 0, gettext ("invalid augmentation length"));
+		  readp = cieend;
+		  continue;
+		}
 
 	      const char *hdr = "Augmentation data:";
 	      const char *cp = augmentation + 1;
@@ -5561,6 +5569,13 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
 	      unsigned int augmentationlen;
 	      get_uleb128 (augmentationlen, readp);
 
+	      if (augmentationlen > (size_t) (dataend - readp))
+		{
+		  error (0, 0, gettext ("invalid augmentation length"));
+		  readp = cieend;
+		  continue;
+		}
+
 	      if (augmentationlen > 0)
 		{
 		  const char *hdr = "Augmentation data:";
-- 
1.8.3.1