diff --git a/binutils/ChangeLog b/binutils/ChangeLog index 951673bd6a..8bb1fc5052 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2017-04-28 Nick Clifton + + PR binutils/21437 + * readelf.c (process_version_sections): Check for underflow when + computing the start address of the auxillary version data. + 2017-04-28 Nick Clifton PR binutils/21438 diff --git a/binutils/readelf.c b/binutils/readelf.c index b57e1e029b..72f9dda644 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -10178,8 +10178,9 @@ process_version_sections (FILE * file) printf (_(" Index: %d Cnt: %d "), ent.vd_ndx, ent.vd_cnt); - /* Check for overflow. */ - if (ent.vd_aux + sizeof (* eaux) > (size_t) (endbuf - vstart)) + /* Check for overflow and underflow. */ + if (ent.vd_aux + sizeof (* eaux) > (size_t) (endbuf - vstart) + || (vstart + ent.vd_aux < vstart)) break; vstart += ent.vd_aux;