espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-10-17 04:43:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixes for memory access violations triggered by running readelf on fuzzed binaries.

Browse Source 
PR binutils/17531
	* dwarf.c (display_debug_aranges): Add check for an excessive
	ar_length value.
	(process_cu_tu_index): Check for a row * columns sum being too
	large.
This commit is contained in:
Nick Clifton
2015-02-13 14:17:18 +00:00
parent 951eaaec17
commit ffc0f143c7
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
binutils/ChangeLog
View File

@ -8,6 +8,12 @@
available before parsing. available before parsing.
(prescan): Likewise. (prescan): Likewise.
PR binutils/17531
* dwarf.c (display_debug_aranges): Add check for an excessive
ar_length value.
(process_cu_tu_index): Check for a row * columns sum being too
large.
2015-02-13 Alan Modra <amodra@gmail.com> 2015-02-13 Alan Modra <amodra@gmail.com>
* dwarf.c: Formatting, whitespace. * dwarf.c: Formatting, whitespace.

15
binutils/dwarf.c
View File

@ -4923,7 +4923,13 @@ display_debug_aranges (struct dwarf_section *section,
if (excess) if (excess)
addr_ranges += (2 * address_size) - excess; addr_ranges += (2 * address_size) - excess;
start += arange.ar_length + initial_length_size; hdrptr = start + arange.ar_length + initial_length_size;
if (hdrptr < start || hdrptr > end)
{
error (_("Excessive header length: %lx\n"), (long) arange.ar_length);
break;
}
start = hdrptr;
while (addr_ranges + 2 * address_size <= start) while (addr_ranges + 2 * address_size <= start)
{ {
@ -7084,6 +7090,13 @@ process_cu_tu_index (struct dwarf_section *section, int do_display)
memcpy (&this_set[row - 1].signature, ph, sizeof (uint64_t)); memcpy (&this_set[row - 1].signature, ph, sizeof (uint64_t));
prow = poffsets + (row - 1) * ncols * 4; prow = poffsets + (row - 1) * ncols * 4;
/* PR 17531: file: b8ce60a8. */
if (prow < poffsets || prow > limit)
{
warn (_("Row index (%u) * num columns (%u) > space remaining in section\n"),
row, ncols);
return 0;
}
if (do_display) if (do_display)
printf (_(" [%3d] 0x%s"), printf (_(" [%3d] 0x%s"),