From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============3576012210355923435==" MIME-Version: 1.0 From: Mark Wielaard To: elfutils-devel@lists.fedorahosted.org Subject: [COMMITTED] readelf: Sanity check CIE unit_length and augmentationlen in debug_frame. Date: Fri, 14 Nov 2014 21:45:42 +0100 Message-ID: <1415997942-1929-1-git-send-email-mjw@redhat.com> --===============3576012210355923435== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Signed-off-by: Mark Wielaard --- src/ChangeLog | 5 +++++ src/readelf.c | 17 ++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/src/ChangeLog b/src/ChangeLog index be1d55f..7561041 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,5 +1,10 @@ 2014-11-14 Mark Wielaard = + * readelf.c (print_debug_frame_section): Sanity Check CIE + unit_length and augmentationlen. + +2014-11-14 Mark Wielaard + * readelf.c (handle_versym): Check def =3D=3D NULL before use. = 2014-11-08 Mark Wielaard diff --git a/src/readelf.c b/src/readelf.c index 243e16e..065ee1c 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -5332,6 +5332,10 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl= *ebl, GElf_Ehdr *ehdr, continue; } = + Dwarf_Word maxsize =3D dataend - readp; + if (unlikely (unit_length > maxsize)) + goto invalid_data; + unsigned int ptr_size =3D ehdr->e_ident[EI_CLASS] =3D=3D ELFCLASS32 = ? 4 : 8; = ptrdiff_t start =3D readp - (unsigned char *) data->d_buf; @@ -5413,7 +5417,11 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl= *ebl, GElf_Ehdr *ehdr, get_uleb128 (augmentationlen, readp); = if (augmentationlen > (size_t) (dataend - readp)) - error (1, 0, gettext ("invalid augmentation length")); + { + error (0, 0, gettext ("invalid augmentation length")); + readp =3D cieend; + continue; + } = const char *hdr =3D "Augmentation data:"; const char *cp =3D augmentation + 1; @@ -5561,6 +5569,13 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl= *ebl, GElf_Ehdr *ehdr, unsigned int augmentationlen; get_uleb128 (augmentationlen, readp); = + if (augmentationlen > (size_t) (dataend - readp)) + { + error (0, 0, gettext ("invalid augmentation length")); + readp =3D cieend; + continue; + } + if (augmentationlen > 0) { const char *hdr =3D "Augmentation data:"; -- = 1.8.3.1 --===============3576012210355923435==--