espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-24 12:23:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

xcoff slurp_armap bounds checking

Browse Source 
"count * 8 >= size" might overflow, "count >= size / 8" doesn't.

	* coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when
	checking symbol count against section size.  Guard against strlen
	running off end of buffer by allocating one more byte and zeroing.
	* coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
This commit is contained in:
Alan Modra
2019-12-19 21:46:01 +10:30
parent f00901886d
commit 228c8f4be0
3 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bfd/ChangeLog
View File

@ -1,3 +1,10 @@
2019-12-18 Alan Modra <amodra@gmail.com>
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when
checking symbol count against section size. Guard against strlen
running off end of buffer by allocating one more byte and zeroing.
* coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
2019-12-18 Alan Modra <amodra@gmail.com> 2019-12-18 Alan Modra <amodra@gmail.com>
* elf32-ppc.c (ppc_elf_get_synthetic_symtab): Use size_t for vars. * elf32-ppc.c (ppc_elf_get_synthetic_symtab): Use size_t for vars.

26
bfd/coff-rs6000.c
View File

@ -1260,18 +1260,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
return FALSE; return FALSE;
GET_VALUE_IN_FIELD (sz, hdr.size, 10); GET_VALUE_IN_FIELD (sz, hdr.size, 10);
if (sz == (bfd_size_type) -1)
{
bfd_set_error (bfd_error_no_memory);
return FALSE;
}
/* Read in the entire symbol table. */ /* Read in the entire symbol table. */
contents = (bfd_byte *) bfd_alloc (abfd, sz); contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
if (contents == NULL) if (contents == NULL)
return FALSE; return FALSE;
if (bfd_bread (contents, sz, abfd) != sz) if (bfd_bread (contents, sz, abfd) != sz)
return FALSE; return FALSE;
/* Ensure strings are NULL terminated so we don't wander off the
end of the buffer. */
contents[sz] = 0;
/* The symbol table starts with a four byte count. */ /* The symbol table starts with a four byte count. */
c = H_GET_32 (abfd, contents); c = H_GET_32 (abfd, contents);
if (c * 4 >= sz) if (c >= sz / 4)
{ {
bfd_set_error (bfd_error_bad_value); bfd_set_error (bfd_error_bad_value);
return FALSE; return FALSE;
@ -1315,18 +1324,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
return FALSE; return FALSE;
GET_VALUE_IN_FIELD (sz, hdr.size, 10); GET_VALUE_IN_FIELD (sz, hdr.size, 10);
if (sz == (bfd_size_type) -1)
{
bfd_set_error (bfd_error_no_memory);
return FALSE;
}
/* Read in the entire symbol table. */ /* Read in the entire symbol table. */
contents = (bfd_byte *) bfd_alloc (abfd, sz); contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
if (contents == NULL) if (contents == NULL)
return FALSE; return FALSE;
if (bfd_bread (contents, sz, abfd) != sz) if (bfd_bread (contents, sz, abfd) != sz)
return FALSE; return FALSE;
/* Ensure strings are NULL terminated so we don't wander off the
end of the buffer. */
contents[sz] = 0;
/* The symbol table starts with an eight byte count. */ /* The symbol table starts with an eight byte count. */
c = H_GET_64 (abfd, contents); c = H_GET_64 (abfd, contents);
if (c * 8 >= sz) if (c >= sz / 8)
{ {
bfd_set_error (bfd_error_bad_value); bfd_set_error (bfd_error_bad_value);
return FALSE; return FALSE;

13
bfd/coff64-rs6000.c
View File

@ -1933,18 +1933,27 @@ xcoff64_slurp_armap (bfd *abfd)
return FALSE; return FALSE;
sz = bfd_scan_vma (hdr.size, (const char **) NULL, 10); sz = bfd_scan_vma (hdr.size, (const char **) NULL, 10);
if (sz == (bfd_size_type) -1)
{
bfd_set_error (bfd_error_no_memory);
return FALSE;
}
/* Read in the entire symbol table. */ /* Read in the entire symbol table. */
contents = (bfd_byte *) bfd_alloc (abfd, sz); contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
if (contents == NULL) if (contents == NULL)
return FALSE; return FALSE;
if (bfd_bread (contents, sz, abfd) != sz) if (bfd_bread (contents, sz, abfd) != sz)
return FALSE; return FALSE;
/* Ensure strings are NULL terminated so we don't wander off the end
of the buffer. */
contents[sz] = 0;
/* The symbol table starts with an eight byte count. */ /* The symbol table starts with an eight byte count. */
c = H_GET_64 (abfd, contents); c = H_GET_64 (abfd, contents);
if (c * 8 >= sz) if (c >= sz / 8)
{ {
bfd_set_error (bfd_error_bad_value); bfd_set_error (bfd_error_bad_value);
return FALSE; return FALSE;