libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable() that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.

Use-after-free vulnerability was reported in libdwarf [1]. If dwarfdump is passed a corrupted ELF file, 'DwarfDebug' object will be freed in 'dwarfelfobjectaccessfinish', but then this object is being referenced later in 'printerror':

-------------------------------- res = dwarfobjectinit(binaryinterface, errhand, errarg, retdbg, error); if (res != DWDLVOK){ dwarfelfobjectaccessfinish(binaryinterface); } -------------------------------- ... -------------------------- if (obj->object) { dwarfelfobjectaccessinternalst internals = (dwarfelfobjectaccessinternalst )obj->object; --------------------------

[1]: https://bugzilla.redhat.com/showbug.cgi?id=1177758