espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-18 00:32:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add ECOFF Symbolic Header sanity checks

Browse Source 
Anti-fuzzer measures.  The checks don't ensure the various elements in
the header are distinct, but that isn't important as far as making
sure we don't overrun the buffer containing all the elements.  Also,
we now don't care about offsets where the corresponding count is zero.

	* ecoff.c (_bfd_ecoff_slurp_symbolic_info): Sanity check offsets
	in debug->symbolic_header.
This commit is contained in:
Alan Modra
2023-02-02 22:39:31 +10:30
parent e0df1fd784
commit 96e034530e
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
bfd/ecoff.c
View File

@ -527,12 +527,24 @@ _bfd_ecoff_slurp_symbolic_info (bfd *abfd,
documented section. And the ordering of the sections varies between documented section. And the ordering of the sections varies between
statically and dynamically linked executables. statically and dynamically linked executables.
If bfd supports SEEK_END someday, this code could be simplified. */ If bfd supports SEEK_END someday, this code could be simplified. */
raw_end = 0; raw_end = raw_base;
#define UPDATE_RAW_END(start, count, size) \ #define UPDATE_RAW_END(start, count, size) \
cb_end = internal_symhdr->start + internal_symhdr->count * (size); \ do \
if (cb_end > raw_end) \ if (internal_symhdr->count != 0) \
raw_end = cb_end { \
if (internal_symhdr->start < raw_base) \
goto err; \
if (_bfd_mul_overflow ((unsigned long) internal_symhdr->count, \
(size), &amt)) \
goto err; \
cb_end = internal_symhdr->start + amt; \
if (cb_end < internal_symhdr->start) \
goto err; \
if (cb_end > raw_end) \
raw_end = cb_end; \
} \
while (0)
UPDATE_RAW_END (cbLineOffset, cbLine, sizeof (unsigned char)); UPDATE_RAW_END (cbLineOffset, cbLine, sizeof (unsigned char));
UPDATE_RAW_END (cbDnOffset, idnMax, backend->debug_swap.external_dnr_size); UPDATE_RAW_END (cbDnOffset, idnMax, backend->debug_swap.external_dnr_size);
@ -599,6 +611,7 @@ _bfd_ecoff_slurp_symbolic_info (bfd *abfd,
if (_bfd_mul_overflow ((unsigned long) internal_symhdr->ifdMax, if (_bfd_mul_overflow ((unsigned long) internal_symhdr->ifdMax,
sizeof (struct fdr), &amt)) sizeof (struct fdr), &amt))
{ {
err:
bfd_set_error (bfd_error_file_too_big); bfd_set_error (bfd_error_file_too_big);
return false; return false;
} }