PR24876, readelf: heap-buffer-overflow in dump_ia64_unwind
authorAlan Modra <amodra@gmail.com>
Wed, 7 Aug 2019 02:20:28 +0000 (11:50 +0930)
committerAlan Modra <amodra@gmail.com>
Wed, 7 Aug 2019 02:30:06 +0000 (12:00 +0930)
PR 24876
* readelf.c (dump_ia64_unwind): Check that buffer is large
enough for "stamp" before reading.

binutils/ChangeLog
binutils/readelf.c

index 411f835ef892d5129dec758214209c9070b4a290..f60d5ffbb02ab04bc444f94c2c84b47a43d98608 100644 (file)
@@ -1,3 +1,9 @@
+2019-08-07  Alan Modra  <amodra@gmail.com>
+
+       PR 24876
+       * readelf.c (dump_ia64_unwind): Check that buffer is large
+       enough for "stamp" before reading.
+
 2019-08-05  Nick Clifton  <nickc@redhat.com>
 
        PR 24874
index e785fde43e7c0de796dd77e1e689826370a3e4c6..5e18734f10b9455e9bac3dd6b875fbd820730e39 100644 (file)
@@ -7574,7 +7574,8 @@ dump_ia64_unwind (Filedata * filedata, struct ia64_unw_aux_info * aux)
        }
       offset -= aux->info_addr;
       /* PR 17531: file: 0997b4d1.  */
-      if (offset >= aux->info_size)
+      if (offset >= aux->info_size
+         || aux->info_size - offset < 8)
        {
          warn (_("Invalid offset %lx in table entry %ld\n"),
                (long) tp->info.offset, (long) (tp - aux->table));
This page took 0.044435 seconds and 4 git commands to generate.