OpenE2K
/
binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix potential illegal memory access by readelf when parsing corrupt IA64 unwind information. 

PR 24244
	* unwind-ia64.c (unw_decode_uleb128): Add end parameter, use it to
	prevent walking off the end of the buffer.
	(unw_decode_x1): Add end paramter, pass it to unw_decode_uleb128.
	(unw_decode_x2): Likewise.
	(unw_decode_x3): Likewise.
	(unw_decode_x4): Likewise.
	(unw_decode_r2): Pass the end parameter to unw_decode_uleb128.
	(unw_decode_r3): Likewise.
	(unw_decode_p7_p10): Likewise.
	(unw_decode_b2): Likewise.
	(unw_decode_b3_x4): Likewise.
This commit is contained in:
Nick Clifton 2019-02-20 17:25:33 +00:00
parent 7fc0c668f2
commit 171375c68e
2 changed files with 50 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
binutils/ChangeLog
View File

@ -1,11 +1,25 @@
2019-02-20 Nick Clifton <nickc@redhat.com>
PR 24242
* readelf.c (print_ia64_vms_note): Harden against corrupt notes.
PR 24244
* unwind-ia64.c (unw_decode_uleb128): Add end parameter, use it to
prevent walking off the end of the buffer.
(unw_decode_x1): Add end paramter, pass it to unw_decode_uleb128.
(unw_decode_x2): Likewise.
(unw_decode_x3): Likewise.
(unw_decode_x4): Likewise.
(unw_decode_r2): Pass the end parameter to unw_decode_uleb128.
(unw_decode_r3): Likewise.
(unw_decode_p7_p10): Likewise.
(unw_decode_b2): Likewise.
(unw_decode_b3_x4): Likewise.
PR 24243
* readelf.c (process_mips_specific): Check for an options section
that is too small to even contain a single option.
PR 24242
* readelf.c (print_ia64_vms_note): Harden against corrupt notes.
2019-02-20 Alan Modra <amodra@gmail.com>
PR 24132

68
binutils/unwind-ia64.c
View File

@ -542,13 +542,13 @@ typedef bfd_vma unw_word;
*/
static unw_word
unw_decode_uleb128 (const unsigned char **dpp)
unw_decode_uleb128 (const unsigned char **dpp, const unsigned char * end)
{
unsigned shift = 0;
unw_word byte, result = 0;
const unsigned char *bp = *dpp;
while (1)
while (bp < end)
{
byte = *bp++;
result |= (byte & 0x7f) << shift;
@ -566,14 +566,14 @@ unw_decode_uleb128 (const unsigned char **dpp)
static const unsigned char *
unw_decode_x1 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
void *arg ATTRIBUTE_UNUSED)
void *arg ATTRIBUTE_UNUSED, const unsigned char * end)
{
unsigned char byte1, abreg;
unw_word t, off;
byte1 = *dp++;
t = unw_decode_uleb128 (&dp);
off = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
off = unw_decode_uleb128 (&dp, end);
abreg = (byte1 & 0x7f);
if (byte1 & 0x80)
UNW_DEC_SPILL_SPREL ("X1", t, abreg, off, arg);
@ -584,14 +584,14 @@ unw_decode_x1 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
static const unsigned char *
unw_decode_x2 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
void *arg ATTRIBUTE_UNUSED)
void *arg ATTRIBUTE_UNUSED, const unsigned char * end)
{
unsigned char byte1, byte2, abreg, x, ytreg;
unw_word t;
byte1 = *dp++;
byte2 = *dp++;
t = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
abreg = (byte1 & 0x7f);
ytreg = byte2;
x = (byte1 >> 7) & 1;
@ -604,15 +604,15 @@ unw_decode_x2 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
static const unsigned char *
unw_decode_x3 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
void *arg ATTRIBUTE_UNUSED)
void *arg ATTRIBUTE_UNUSED, const unsigned char * end)
{
unsigned char byte1, byte2, abreg, qp;
unw_word t, off;
byte1 = *dp++;
byte2 = *dp++;
t = unw_decode_uleb128 (&dp);
off = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
off = unw_decode_uleb128 (&dp, end);
qp = (byte1 & 0x3f);
abreg = (byte2 & 0x7f);
@ -626,7 +626,7 @@ unw_decode_x3 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
static const unsigned char *
unw_decode_x4 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
void *arg ATTRIBUTE_UNUSED)
void *arg ATTRIBUTE_UNUSED, const unsigned char * end)
{
unsigned char byte1, byte2, byte3, qp, abreg, x, ytreg;
unw_word t;
@ -634,7 +634,7 @@ unw_decode_x4 (const unsigned char *dp, unsigned int code ATTRIBUTE_UNUSED,
byte1 = *dp++;
byte2 = *dp++;
byte3 = *dp++;
t = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
qp = (byte1 & 0x3f);
abreg = (byte2 & 0x7f);
@ -662,7 +662,7 @@ unw_decode_r1 (const unsigned char *dp, unsigned int code, void *arg,
static const unsigned char *
unw_decode_r2 (const unsigned char *dp, unsigned int code, void *arg,
const unsigned char * end ATTRIBUTE_UNUSED)
const unsigned char * end)
{
unsigned char byte1, mask, grsave;
unw_word rlen;
@ -671,18 +671,18 @@ unw_decode_r2 (const unsigned char *dp, unsigned int code, void *arg,
mask = ((code & 0x7) << 1) | ((byte1 >> 7) & 1);
grsave = (byte1 & 0x7f);
rlen = unw_decode_uleb128 (& dp);
rlen = unw_decode_uleb128 (& dp, end);
UNW_DEC_PROLOGUE_GR ("R2", rlen, mask, grsave, arg);
return dp;
}
static const unsigned char *
unw_decode_r3 (const unsigned char *dp, unsigned int code, void *arg,
const unsigned char * end ATTRIBUTE_UNUSED)
const unsigned char * end)
{
unw_word rlen;
rlen = unw_decode_uleb128 (& dp);
rlen = unw_decode_uleb128 (& dp, end);
UNW_DEC_PROLOGUE ("R3", ((code & 0x3) == 1), rlen, arg);
return dp;
}
@ -795,7 +795,7 @@ unw_decode_p6 (const unsigned char *dp, unsigned int code,
static const unsigned char *
unw_decode_p7_p10 (const unsigned char *dp, unsigned int code, void *arg,
const unsigned char * end ATTRIBUTE_UNUSED)
const unsigned char * end)
{
unsigned char r, byte1, byte2;
unw_word t, size;
@ -803,11 +803,11 @@ unw_decode_p7_p10 (const unsigned char *dp, unsigned int code, void *arg,
if ((code & 0x10) == 0)
{
r = (code & 0xf);
t = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
switch (r)
{
case 0:
size = unw_decode_uleb128 (&dp);
size = unw_decode_uleb128 (&dp, end);
UNW_DEC_MEM_STACK_F ("P7", t, size, arg);
break;
@ -868,7 +868,7 @@ unw_decode_p7_p10 (const unsigned char *dp, unsigned int code, void *arg,
case 0x0: /* p8 */
{
r = *dp++;
t = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
switch (r)
{
case 1:
@ -948,16 +948,16 @@ unw_decode_p7_p10 (const unsigned char *dp, unsigned int code, void *arg,
break;
case 0x9:
return unw_decode_x1 (dp, code, arg);
return unw_decode_x1 (dp, code, arg, end);
case 0xa:
return unw_decode_x2 (dp, code, arg);
return unw_decode_x2 (dp, code, arg, end);
case 0xb:
return unw_decode_x3 (dp, code, arg);
return unw_decode_x3 (dp, code, arg, end);
case 0xc:
return unw_decode_x4 (dp, code, arg);
return unw_decode_x4 (dp, code, arg, end);
default:
UNW_DEC_BAD_CODE (code);
@ -984,30 +984,30 @@ unw_decode_b1 (const unsigned char *dp, unsigned int code,
static const unsigned char *
unw_decode_b2 (const unsigned char *dp, unsigned int code,
void *arg ATTRIBUTE_UNUSED,
const unsigned char * end ATTRIBUTE_UNUSED)
const unsigned char * end)
{
unw_word t;
t = unw_decode_uleb128 (& dp);
t = unw_decode_uleb128 (& dp, end);
UNW_DEC_EPILOGUE ("B2", t, (code & 0x1f), arg);
return dp;
}
static const unsigned char *
unw_decode_b3_x4 (const unsigned char *dp, unsigned int code, void *arg,
const unsigned char * end ATTRIBUTE_UNUSED)
const unsigned char * end)
{
unw_word t, ecount, label;
if ((code & 0x10) == 0)
{
t = unw_decode_uleb128 (&dp);
ecount = unw_decode_uleb128 (&dp);
t = unw_decode_uleb128 (&dp, end);
ecount = unw_decode_uleb128 (&dp, end);
UNW_DEC_EPILOGUE ("B3", t, ecount, arg);
}
else if ((code & 0x07) == 0)
{
label = unw_decode_uleb128 (&dp);
label = unw_decode_uleb128 (&dp, end);
if ((code & 0x08) != 0)
UNW_DEC_COPY_STATE ("B4", label, arg);
else
@ -1017,13 +1017,13 @@ unw_decode_b3_x4 (const unsigned char *dp, unsigned int code, void *arg,
switch (code & 0x7)
{
case 1:
return unw_decode_x1 (dp, code, arg);
return unw_decode_x1 (dp, code, arg, end);
case 2:
return unw_decode_x2 (dp, code, arg);
return unw_decode_x2 (dp, code, arg, end);
case 3:
return unw_decode_x3 (dp, code, arg);
return unw_decode_x3 (dp, code, arg, end);
case 4:
return unw_decode_x4 (dp, code, arg);
return unw_decode_x4 (dp, code, arg, end);
default:
UNW_DEC_BAD_CODE (code);
break;