--- binutils-2.25.1.orig/binutils/readelf.c	2016-01-29 09:54:29.389813964 +0000

+++ binutils-2.25.1/binutils/readelf.c	2016-01-29 09:56:46.388746615 +0000

@@ -7220,7 +7220,10 @@ get_unwind_section_word (struct arm_unw_

     return FALSE;

   /* If the offset is invalid then fail.  */

-  if (word_offset > sec->sh_size - 4)

+  if (word_offset > (sec->sh_size - 4)

+      /* PR 18879 */

+      || (sec->sh_size < 5 && word_offset >= sec->sh_size)

+      || ((bfd_signed_vma) word_offset) < 0)

     return FALSE;

   /* Get the word at the required offset.  */

@@ -7990,6 +7993,15 @@ dump_arm_unwind (struct arm_unw_aux_info

 	    {

 	      table_sec = section_headers + entry_addr.section;

 	      table_offset = entry_addr.offset;

+	      /* PR 18879 */

+	      if (table_offset > table_sec->sh_size

+		  || ((bfd_signed_vma) table_offset) < 0)

+		{

+		  warn (_("Unwind entry contains corrupt offset (0x%lx) into section %s\n"),

+			(unsigned long) table_offset,

+			printable_section_name (table_sec));

+		  continue;

+		}

 	    }

 	  else

 	    {