* dwarf.c (process_debug_info): Check for corrupt lengths.

* readelf.c (get_reloc_type): New function.  Returns the reloc number extracted from the info field of a reloc.
  (get_reloc_symindex): New function.  Returns the symbol index
  (extracted from the info field of a reloc.
  (dump_relocations): Use the new functions.
  (slurp_ia64_unwind_table): Use the new functions.
  (slurp_hppa_unwind_table): Use the new functions.
  (dump_section_as_bytes): Use the new functions.
  (get_reloc_size): Delete function.
  (is_32bit_abs_reloc): New function.  Determines if a given reloc type is a 32-bit absolute relocation.
  (is_32bit_pcrel_reloc): New function.  Like is_32bit_abs_reloc but for pc-relative relocations.
  (is_64bit_abs_reloc): New function.  Like is_32bit_abs_reloc but for 64-bit absolute relocations.
  (is_16bit_abs_reloc): New function.  Like is_32bit_abs_reloc but for 32-bit absolute relocations.
  (debug_apply_rela_addends): Use the new functions.  Skip and warn about any unrecognised relocations.

1 files changed, 9 insertions, 0 deletions

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index c438669..e3231d8 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -1551,6 +1551,15 @@ process_debug_info (struct dwarf_section *section, void *file,
 	    }
 	  else
 	    section_begin += length + 4;
+
+	  /* Negative values are illegal, they may even cause infinite
+	     looping.  This can happen if we can't accurately apply
+	     relocations to an object file.  */
+	  if ((signed long) length <= 0)
+	    {
+	      warn (_("Corrupt unit length (%lx) found in section %s\n"), length, section->name);
+	      return 0;
+	    }
 	}
 
       if (num_units == 0)