espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-28 23:39:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix memort access problems exposed by fuzzed binaries.

Browse Source 
PR binutils/17531
	* readelf.c (get_unwind_section_word): Skip reloc processing if
	there are no relocs associated with the section.
	(decode_tic6x_unwind_bytecode): Warn and return if the stack
	pointer adjustment falls off the end of the buffer.
This commit is contained in:
Nick Clifton
2014-11-18 10:07:11 +00:00
parent 25a0334e39
commit 0eff716535
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
binutils/ChangeLog
View File

@ -1,3 +1,11 @@
2014-11-18 Nick Clifton <nickc@redhat.com>
PR binutils/17531
* readelf.c (get_unwind_section_word): Skip reloc processing if
there are no relocs associated with the section.
(decode_tic6x_unwind_bytecode): Warn and return if the stack
pointer adjustment falls off the end of the buffer.
2014-11-14 Nick Clifton <nickc@redhat.com> 2014-11-14 Nick Clifton <nickc@redhat.com>
PR binutils/17512 PR binutils/17512

16
binutils/readelf.c
View File

@ -7089,6 +7089,13 @@ get_unwind_section_word (struct arm_unw_aux_info * aux,
/* Get the word at the required offset. */ /* Get the word at the required offset. */
word = byte_get (arm_sec->data + word_offset, 4); word = byte_get (arm_sec->data + word_offset, 4);
/* PR 17531: file: id:000001,src:001266+003044,op:splice,rep:128. */
if (arm_sec->rela == NULL)
{
* wordp = word;
return TRUE;
}
/* Look through the relocs to find the one that applies to the provided offset. */ /* Look through the relocs to find the one that applies to the provided offset. */
wrapped = FALSE; wrapped = FALSE;
for (rp = arm_sec->next_rela; rp != arm_sec->rela + arm_sec->nrelas; rp++) for (rp = arm_sec->next_rela; rp != arm_sec->rela + arm_sec->nrelas; rp++)
@ -7583,7 +7590,14 @@ decode_tic6x_unwind_bytecode (struct arm_unw_aux_info *aux,
if ((buf[i] & 0x80) == 0) if ((buf[i] & 0x80) == 0)
break; break;
} }
assert (i < sizeof (buf)); /* PR 17531: file: id:000001,src:001906+004739,op:splice,rep:2. */
if (i == sizeof (buf))
{
printf ("<corrupt sp adjust>\n");
warn (_("Corrupt stack pointer adjustment detected\n"));
return;
}
offset = read_uleb128 (buf, &len, buf + i + 1); offset = read_uleb128 (buf, &len, buf + i + 1);
assert (len == i + 1); assert (len == i + 1);
offset = offset * 8 + 0x408; offset = offset * 8 + 0x408;