espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-08-03 04:01:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Unsigned integer overflows in readelf checks

Browse Source 
PR 24132
	PR 24138
	* readelf.c (get_data): Avoid possibility of overflow when
	checking for a read that may extend past end of file.
	(process_program_headers): Likewise.
This commit is contained in:
Alan Modra
2019-02-20 18:22:50 +10:30
parent edd01d077c
commit c22b42ce30
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
binutils/ChangeLog
View File

@ -1,3 +1,11 @@
2019-02-20 Alan Modra <amodra@gmail.com>
PR 24132
PR 24138
* readelf.c (get_data): Avoid possibility of overflow when
checking for a read that may extend past end of file.
(process_program_headers): Likewise.
2019-02-20 Alan Modra <amodra@gmail.com>
PR 24233

10
binutils/readelf.c
View File

@ -398,10 +398,11 @@ get_data (void * var,
return NULL;
}
/* Be kind to memory chekers (eg valgrind, address sanitizer) by not
/* Be kind to memory checkers (eg valgrind, address sanitizer) by not
attempting to allocate memory when the read is bound to fail. */
if (amt > filedata->file_size
|| offset + archive_file_offset + amt > filedata->file_size)
if (archive_file_offset > filedata->file_size
|| offset > filedata->file_size - archive_file_offset
|| amt > filedata->file_size - archive_file_offset - offset)
{
if (reason)
error (_("Reading %s bytes extends past end of file for %s\n"),
@ -5235,7 +5236,8 @@ process_program_headers (Filedata * filedata)
segment. Check this after matching against the section headers
so we don't warn on debuginfo file (which have NOBITS .dynamic
sections). */
if (dynamic_addr + dynamic_size >= filedata->file_size)
if (dynamic_addr > filedata->file_size
|| dynamic_size > filedata->file_size - dynamic_addr)
{
error (_("the dynamic segment offset + size exceeds the size of the file\n"));
dynamic_addr = dynamic_size = 0;