[COMMITTED] readelf: Sanity check CIE unit_length and augmentationlen in debug_frame.

[Mark Wielaard]

Signed-off-by: Mark Wielaard <m...@redhat.com>
---
 src/ChangeLog |  5 +++++
 src/readelf.c | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/ChangeLog b/src/ChangeLog
index be1d55f..7561041 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
 2014-11-14  Mark Wielaard  <m...@redhat.com>
 
+       * readelf.c (print_debug_frame_section): Sanity Check CIE
+       unit_length and augmentationlen.
+
+2014-11-14  Mark Wielaard  <m...@redhat.com>
+
        * readelf.c (handle_versym): Check def == NULL before use.
 
 2014-11-08  Mark Wielaard  <m...@redhat.com>
diff --git a/src/readelf.c b/src/readelf.c
index 243e16e..065ee1c 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5332,6 +5332,10 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl 
*ebl, GElf_Ehdr *ehdr,
          continue;
        }
 
+      Dwarf_Word maxsize = dataend - readp;
+      if (unlikely (unit_length > maxsize))
+       goto invalid_data;
+
       unsigned int ptr_size = ehdr->e_ident[EI_CLASS] == ELFCLASS32 ? 4 : 8;
 
       ptrdiff_t start = readp - (unsigned char *) data->d_buf;
@@ -5413,7 +5417,11 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl 
*ebl, GElf_Ehdr *ehdr,
              get_uleb128 (augmentationlen, readp);
 
              if (augmentationlen > (size_t) (dataend - readp))
-               error (1, 0, gettext ("invalid augmentation length"));
+               {
+                 error (0, 0, gettext ("invalid augmentation length"));
+                 readp = cieend;
+                 continue;
+               }
 
              const char *hdr = "Augmentation data:";
              const char *cp = augmentation + 1;
@@ -5561,6 +5569,13 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl 
*ebl, GElf_Ehdr *ehdr,
              unsigned int augmentationlen;
              get_uleb128 (augmentationlen, readp);
 
+             if (augmentationlen > (size_t) (dataend - readp))
+               {
+                 error (0, 0, gettext ("invalid augmentation length"));
+                 readp = cieend;
+                 continue;
+               }
+
              if (augmentationlen > 0)
                {
                  const char *hdr = "Augmentation data:";
-- 
1.8.3.1