espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-19 09:14:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

_bfd_clear_contents bounds checking

Browse Source 
This PR shows a fuzzed binary triggering a segfault via a bad
relocation in .debug_line.  It turns out that unlike normal
relocations applied to a section, the linker applies those with
symbols from discarded sections via _bfd_clear_contents without
checking that the relocation is within the section bounds.  The same
thing now happens when reading debug sections since commit
a4cd947aca23, the PR23425 fix.

	PR 23770
	PR 23425
	* reloc.c (_bfd_clear_contents): Replace "location" param with
	"buf" and "off".  Bounds check "off".  Return status.
	* cofflink.c (_bfd_coff_generic_relocate_section): Update
	_bfd_clear_contents call.
	* elf-bfd.h (RELOC_AGAINST_DISCARDED_SECTION): Likewise.
	* elf32-arc.c (elf_arc_relocate_section): Likewise.
	* elf32-i386.c (elf_i386_relocate_section): Likewise.
	* elf32-metag.c (metag_final_link_relocate): Likewise.
	* elf32-nds32.c (nds32_elf_get_relocated_section_contents): Likewise.
	* elf32-ppc.c (ppc_elf_relocate_section): Likewise.
	* elf32-visium.c (visium_elf_relocate_section): Likewise.
	* elf64-ppc.c (ppc64_elf_relocate_section): Likewise.
	* elf64-x86-64.c *(elf_x86_64_relocate_section): Likewise.
	* libbfd-in.h (_bfd_clear_contents): Update prototype.
	* libbfd.h: Regenerate.
This commit is contained in:
Alan Modra
2018-10-13 22:03:02 +10:30
parent 2bf2bf23da
commit 0930cb3021
14 changed files with 50 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bfd/libbfd-in.h
View File

@ -697,8 +697,8 @@ extern bfd_reloc_status_type _bfd_relocate_contents
(reloc_howto_type *, bfd *, bfd_vma, bfd_byte *) ATTRIBUTE_HIDDEN;
/* Clear a given location using a given howto. */
extern void _bfd_clear_contents
(reloc_howto_type *, bfd *, asection *, bfd_byte *) ATTRIBUTE_HIDDEN;
extern bfd_reloc_status_type _bfd_clear_contents
(reloc_howto_type *, bfd *, asection *, bfd_byte *, bfd_vma) ATTRIBUTE_HIDDEN;
/* Link stabs in sections in the first pass. */