From f32ba72991d2406b21ab17edc234a2f3fa7fb23d Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Mon, 3 Apr 2017 11:01:45 +0100 Subject: [PATCH] readelf: Update check for invalid word offsets in ARM unwind information. PR binutils/21343 * readelf.c (get_unwind_section_word): Fix snafu checking for invalid word offsets in ARM unwind information. Upstream-Status: Backport CVE: CVE-2017-9038 CVE: CVE-2017-9044 Signed-off-by: Armin Kuster --- binutils/ChangeLog | 6 ++++++ binutils/readelf.c | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) Index: git/binutils/readelf.c =================================================================== --- git.orig/binutils/readelf.c +++ git/binutils/readelf.c @@ -7972,9 +7972,9 @@ get_unwind_section_word (struct arm_unw_ return FALSE; /* If the offset is invalid then fail. */ - if (word_offset > (sec->sh_size - 4) - /* PR 18879 */ - || (sec->sh_size < 5 && word_offset >= sec->sh_size) + if (/* PR 21343 *//* PR 18879 */ + sec->sh_size < 4 + || word_offset > (sec->sh_size - 4) || ((bfd_signed_vma) word_offset) < 0) return FALSE; Index: git/binutils/ChangeLog =================================================================== --- git.orig/binutils/ChangeLog +++ git/binutils/ChangeLog @@ -1,3 +1,9 @@ +2017-04-03 Nick Clifton + + PR binutils/21343 + * readelf.c (get_unwind_section_word): Fix snafu checking for + invalid word offsets in ARM unwind information. + 2017-05-02 Nick Clifton PR 21440