readelf: Sanity check CIE unit_length and augmentationlen in debug_frame.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/src/ChangeLog b/src/ChangeLog
index be1d55fb91651bb5a5e3fb064796bc0c6a2fb423..756104173809a31cbe969b41550af60569c2c3ff 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2014-11-14  Mark Wielaard  <mjw@redhat.com>
+
+       * readelf.c (print_debug_frame_section): Sanity Check CIE
+       unit_length and augmentationlen.
+
 2014-11-14  Mark Wielaard  <mjw@redhat.com>
 
        * readelf.c (handle_versym): Check def == NULL before use.

diff --git a/src/readelf.c b/src/readelf.c
index 243e16e58ab98b4347cf1852fc781f4acaed7fc2..065ee1c34e8aa5c5fce3dad18e3a9cd221eb5e18 100644 (file)
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5332,6 +5332,10 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
          continue;
        }
 
+      Dwarf_Word maxsize = dataend - readp;
+      if (unlikely (unit_length > maxsize))
+       goto invalid_data;
+
       unsigned int ptr_size = ehdr->e_ident[EI_CLASS] == ELFCLASS32 ? 4 : 8;
 
       ptrdiff_t start = readp - (unsigned char *) data->d_buf;
@@ -5413,7 +5417,11 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
              get_uleb128 (augmentationlen, readp);
 
              if (augmentationlen > (size_t) (dataend - readp))
-               error (1, 0, gettext ("invalid augmentation length"));
+               {
+                 error (0, 0, gettext ("invalid augmentation length"));
+                 readp = cieend;
+                 continue;
+               }
 
              const char *hdr = "Augmentation data:";
              const char *cp = augmentation + 1;
@@ -5561,6 +5569,13 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
              unsigned int augmentationlen;
              get_uleb128 (augmentationlen, readp);
 
+             if (augmentationlen > (size_t) (dataend - readp))
+               {
+                 error (0, 0, gettext ("invalid augmentation length"));
+                 readp = cieend;
+                 continue;
+               }
+
              if (augmentationlen > 0)
                {
                  const char *hdr = "Augmentation data:";