espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-03 05:12:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

This patch fixes a flaw in the SREC parser which could cause a stack overflow

Browse Source 
and potential secuiryt breach.

	PR binutils/17510
	* srec.c (srec_bad_byte): Increase size of buf to allow for
	negative values.
	(srec_scan): Use an unsigned char buffer to hold header bytes.
This commit is contained in:
Nick Clifton
2014-10-28 10:48:14 +00:00
parent 6fb9c0f832
commit 708d7d0d11
4 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
bfd/ChangeLog
View File

@ -1,3 +1,11 @@
2014-10-28 Andreas Schwab <schwab@suse.de>
Nick Clifton <nickc@redhat.com>
PR binutils/17510
* srec.c (srec_bad_byte): Increase size of buf to allow for
negative values.
(srec_scan): Use an unsigned char buffer to hold header bytes.
2014-10-27 Nick Clifton <nickc@redhat.com>
PR binutils/17512

2
bfd/elf.c
View File

@ -629,7 +629,7 @@ setup_group (bfd *abfd, Elf_Internal_Shdr *hdr, asection *newsect)
memset (shdr->contents, 0, amt);
continue;
}
/* Translate raw contents, a flag word followed by an
array of elf section indices all in target byte order,
to the flag word followed by an array of elf section

1
bfd/peXXigen.c
View File

@ -515,7 +515,6 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd,
a->NumberOfRvaAndSizes = 0;
}
for (idx = 0; idx < a->NumberOfRvaAndSizes; idx++)
{
/* If data directory is empty, rva also should be 0. */

4
bfd/srec.c
View File

@ -246,7 +246,7 @@ srec_bad_byte (bfd *abfd,
}
else
{
char buf[10];
char buf[40];
if (! ISPRINT (c))
sprintf (buf, "\\%03o", (unsigned int) c);
@ -452,7 +452,7 @@ srec_scan (bfd *abfd)
case 'S':
{
file_ptr pos;
char hdr[3];
unsigned char hdr[3];
unsigned int bytes, min_bytes;
bfd_vma address;
bfd_byte *data;