--- binutils-2.25.1.orig/binutils/readelf.c 2016-01-29 09:54:29.389813964 +0000 +++ binutils-2.25.1/binutils/readelf.c 2016-01-29 09:56:46.388746615 +0000 @@ -7220,7 +7220,10 @@ get_unwind_section_word (struct arm_unw_ return FALSE; /* If the offset is invalid then fail. */ - if (word_offset > sec->sh_size - 4) + if (word_offset > (sec->sh_size - 4) + /* PR 18879 */ + || (sec->sh_size < 5 && word_offset >= sec->sh_size) + || ((bfd_signed_vma) word_offset) < 0) return FALSE; /* Get the word at the required offset. */ @@ -7990,6 +7993,15 @@ dump_arm_unwind (struct arm_unw_aux_info { table_sec = section_headers + entry_addr.section; table_offset = entry_addr.offset; + /* PR 18879 */ + if (table_offset > table_sec->sh_size + || ((bfd_signed_vma) table_offset) < 0) + { + warn (_("Unwind entry contains corrupt offset (0x%lx) into section %s\n"), + (unsigned long) table_offset, + printable_section_name (table_sec)); + continue; + } } else {