[Bug backends/23529] heap-buffer-overflow in eu-readelf

https://sourceware.org/bugzilla/show_bug.cgi?id=23529 Mark Wielaard changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution|---

[Bug libdw/23541] heap-buffer-overflow in /elfutils/libdw/dwarf_getaranges.c:156

https://sourceware.org/bugzilla/show_bug.cgi?id=23541 Mark Wielaard changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution|---

[Bug libelf/23528] When executing ./eu-nm or ./eu-readelf -aAdehIlnrsSVcp -w, AddressSanitizer catch a double-free crash.

https://sourceware.org/bugzilla/show_bug.cgi?id=23528 Mark Wielaard changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution|---

[Bug general/23542] heap-buffer-overflow in /elfutils/src/elflint.c:2055 check_sysv_hash

https://sourceware.org/bugzilla/show_bug.cgi?id=23542 Mark Wielaard changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution|---

[COMMITTED] elflint: Fix check_sysv_hash[64] sanity checks to not overflow.

The sanity checks for how many words were needed in the section could overflow causing errors. Fix the checks. https://sourceware.org/bugzilla/show_bug.cgi?id=23542 Signed-off-by: Mark Wielaard --- src/ChangeLog | 7 +++ src/elflint.c | 7 +-- 2 files changed, 12 insertions(+), 2 deleti

[COMMITTED] libelf: Return error if elf_compress_gnu is used on SHF_COMPRESSED section.

Compressing a section that is already compressed is fine, but useless. But it isn't possible to gnu compress (or decompress) a SHF_COMPRESSED section since there is no state kept that would tell if the section was first GNU compressed or first gabi compressed. Calling elf_compress_gnu on a section

[COMMITTED] libdw, readelf: Make sure there is enough data to read full aranges header.

dwarf_getaranges didn't check if there was enough data left to read both the address and segment size. readelf didn't check there was enough data left to read the segment size. https://sourceware.org/bugzilla/show_bug.cgi?id=23541 Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 5 ++

[COMMITTED] libdw: Check end of attributes list consistently.

dwarf_child (__libdw_find_attr), dwarf_getabbrevattr[_data] and dwarf_getattrs all assume the end of the attribute list is when both the name (code) and form of the attribute are zero. dwarf_getabbrev (__libdw_getabbrev) and dwarf_hasattr assume the end of the attribute list is when either the nam