espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-20 09:58:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Re: asan: buffer overflow in peXXigen.c

Browse Source 
In the process of fixing a buffer overflow in commit fe69d4fcf0194a,
I managed to introduce a fairly obvious NULL pointer dereference..

	* peXXigen.c (_bfd_XX_bfd_copy_private_bfd_data_common): Don't
	segfault on not finding section.  Wrap overlong lines.
This commit is contained in:
Alan Modra
2022-03-17 14:07:16 +10:30
parent 0d1064face
commit c55f2b9c61
1 changed files with 61 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
bfd/peXXigen.c
View File

@ -2984,14 +2984,16 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
one. */
bfd_vma last = addr + size - 1;
asection *section = find_section_by_vma (obfd, last);
if (section != NULL)
{
bfd_byte *data;
bfd_vma dataoff = addr - section->vma;
/* PR 17512: file: 0f15796a. */
if (section
&& (addr < section->vma
if (addr < section->vma
|| section->size < dataoff
|| section->size - dataoff < size))
|| section->size - dataoff < size)
{
/* xgettext:c-format */
_bfd_error_handler
@ -3002,7 +3004,7 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
return false;
}
if (section && bfd_malloc_and_get_section (obfd, section, &data))
if (bfd_malloc_and_get_section (obfd, section, &data))
{
unsigned int i;
struct external_IMAGE_DEBUG_DIRECTORY *dd =
@ -3014,36 +3016,42 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
asection *ddsection;
struct external_IMAGE_DEBUG_DIRECTORY *edd = &(dd[i]);
struct internal_IMAGE_DEBUG_DIRECTORY idd;
bfd_vma idd_vma;
_bfd_XXi_swap_debugdir_in (obfd, edd, &idd);
/* RVA 0 means only offset is valid, not handled yet. */
if (idd.AddressOfRawData == 0)
continue; /* RVA 0 means only offset is valid, not handled yet. */
continue;
ddsection = find_section_by_vma (obfd, idd.AddressOfRawData + ope->pe_opthdr.ImageBase);
idd_vma = idd.AddressOfRawData + ope->pe_opthdr.ImageBase;
ddsection = find_section_by_vma (obfd, idd_vma);
if (!ddsection)
continue; /* Not in a section! */
idd.PointerToRawData = ddsection->filepos + (idd.AddressOfRawData
+ ope->pe_opthdr.ImageBase) - ddsection->vma;
idd.PointerToRawData
= ddsection->filepos + idd_vma - ddsection->vma;
_bfd_XXi_swap_debugdir_out (obfd, &idd, edd);
}
if (!bfd_set_section_contents (obfd, section, data, 0, section->size))
if (!bfd_set_section_contents (obfd, section, data, 0,
section->size))
{
_bfd_error_handler (_("failed to update file offsets in debug directory"));
_bfd_error_handler (_("failed to update file offsets"
" in debug directory"));
free (data);
return false;
}
free (data);
}
else if (section)
else
{
_bfd_error_handler (_("%pB: failed to read debug data section"), obfd);
_bfd_error_handler (_("%pB: failed to read "
"debug data section"), obfd);
return false;
}
}
}
return true;
}