File libdw-readelf-make-sure-there-is-enough-data-to-read.patch of Package elfutils.13244

From 29e31978ba51c1051743a503ee325b5ebc03d7e9 Mon Sep 17 00:00:00 2001
From: Mark Wielaard <mark@klomp.org>
Date: Sat, 18 Aug 2018 13:27:48 +0200
Subject: [PATCH] libdw, readelf: Make sure there is enough data to read full
 aranges header.
Reference: bnc#1106390

dwarf_getaranges didn't check if there was enough data left to read both
the address and segment size. readelf didn't check there was enough data
left to read the segment size.

https://sourceware.org/bugzilla/show_bug.cgi?id=23541

elfutils packaging edits:
 - changelog hunk removed from original patch to avoid conflict

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/ChangeLog          | 5 +++++
 libdw/dwarf_getaranges.c | 4 ++++
 src/ChangeLog            | 5 +++++
 src/readelf.c            | 2 ++
 4 files changed, 16 insertions(+)

diff --git a/libdw/dwarf_getaranges.c b/libdw/dwarf_getaranges.c
index bff9c86..de5b81b 100644
--- a/libdw/dwarf_getaranges.c
+++ b/libdw/dwarf_getaranges.c
@@ -140,6 +140,10 @@
 				   length_bytes, &offset, IDX_debug_info, 4))
 	goto fail;
 
+      /* Next up two bytes for address and segment size.  */
+      if (readp + 2 > readendp)
+	goto invalid;
+
       unsigned int address_size = *readp++;
       if (address_size != 4 && address_size != 8)
 	goto invalid;
diff --git a/src/readelf.c b/src/readelf.c
index 7b5707f..7b488ac 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -4612,6 +4612,8 @@
 	  goto next_table;
 	}
 
+      if (readp + 1 > readendp)
+	goto invalid_data;
       unsigned int segment_size = *readp++;
       printf (gettext (" Segment size:  %6" PRIu64 "\n\n"),
 	      (uint64_t) segment_size);
--
2.9.3