libdw, readelf: Make sure there is enough data to read full aranges header.

dwarf_getaranges didn't check if there was enough data left to read both
the address and segment size. readelf didn't check there was enough data
left to read the segment size.

https://sourceware.org/bugzilla/show_bug.cgi?id=23541

Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index cb4f34ed72b6b4f0394a1bc735e0c6c5969c08fc..472d92283efb513a9ecdcfca5402a931d49a0b46 100644 (file)
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-18  Mark Wielaard  <mark@klomp.org>
+
+       * dwarf_getaranges.c (dwarf_getaranges.c): Make sure there is enough
+       data to read the address and segment size.
+
 2018-07-04  Ross Burton <ross.burton@intel.com>
 
        * libdw_alloc.c: Remove error.h include.

diff --git a/libdw/dwarf_getaranges.c b/libdw/dwarf_getaranges.c
index bff9c86021a40fb1346e2ac278cb2c9b163f5de7..de5b81baa21080503fc93f77cc5bd9fb0f6ceaa0 100644 (file)
--- a/libdw/dwarf_getaranges.c
+++ b/libdw/dwarf_getaranges.c
@@ -148,6 +148,10 @@ dwarf_getaranges (Dwarf *dbg, Dwarf_Aranges **aranges, size_t *naranges)
                                   length_bytes, &offset, IDX_debug_info, 4))
        goto fail;
 
+      /* Next up two bytes for address and segment size.  */
+      if (readp + 2 > readendp)
+       goto invalid;
+
       unsigned int address_size = *readp++;
       if (unlikely (address_size != 4 && address_size != 8))
        goto invalid;

diff --git a/src/ChangeLog b/src/ChangeLog
index 8c89f83d09f30bc46003f3b057eb0e51759bdb4a..2f9f7747516d446fafc1a46084c6e6ee58dd87e0 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-18  Mark Wielaard  <mark@klomp.org>
+
+       * readelf.c (print_debug_aranges_section): Make sure there is enough
+       data to read the header segment size.
+
 2018-08-18  Mark Wielaard  <mark@klomp.org>
 
        * elflint.c (check_sysv_hash): Calculate needed size using unsigned

diff --git a/src/readelf.c b/src/readelf.c
index 7b5707f87d83a4a02348e1d2ca34f83a74b6f13f..7b488ac57bcad759c6dddbf68fc8f0108d5a1603 100644 (file)
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5447,6 +5447,8 @@ print_debug_aranges_section (Dwfl_Module *dwflmod __attribute__ ((unused)),
          goto next_table;
        }
 
+      if (readp + 1 > readendp)
+       goto invalid_data;
       unsigned int segment_size = *readp++;
       printf (gettext (" Segment size:  %6" PRIu64 "\n\n"),
              (uint64_t) segment_size);