readelf: Make sure there is enough room for reading .debug_line unit_length.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/src/ChangeLog b/src/ChangeLog
index e36bb918a6ea5874d2d1e16c753fa988a96fd4a9..eaf60f0a11f2fa69d0ef116f0c186a5d46aba2bd 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,7 +1,8 @@
 2014-12-15  Mark Wielaard  <mjw@redhat.com>
 
        * readelf.c (print_debug_line_section): Check there is enough room
-       for DW_LNE_set_address argument.
+       for DW_LNE_set_address argument. Make sure there is enough room
+       for the the initial unit_length.
 
 2014-12-14  Mark Wielaard  <mjw@redhat.com>
 

diff --git a/src/readelf.c b/src/readelf.c
index faaa6d1b9df59f34f05f2455ad55f756c6372751..cd8ba869fe04534c63e9a95f6d3d9f4a7b943b0a 100644 (file)
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -6333,6 +6333,8 @@ print_debug_line_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
 
       printf (gettext ("\nTable at offset %Zu:\n"), start_offset);
 
+      if (unlikely (linep + 4 > lineendp))
+       goto invalid_data;
       Dwarf_Word unit_length = read_4ubyte_unaligned_inc (dbg, linep);
       unsigned int length = 4;
       if (unlikely (unit_length == 0xffffffff))