OpenE2K
/
binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix seg-fault in readelf when scanniing a corrupt binary. 

PR binutils/18879
	* readelf.c (get_unwind_section_word): Check for negative offsets
	and very small sections.
	(dump_arm_unwind): Warn if the table offset is too large.
This commit is contained in:
Nick Clifton 2015-09-03 16:15:49 +01:00
parent 39edd165f4
commit 1a9155522d
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
binutils/ChangeLog
View File

@ -1,3 +1,10 @@
2015-09-03 Nick Clifton <nickc@redhat.com>
PR binutils/18879
* readelf.c (get_unwind_section_word): Check for negative offsets
and very small sections.
(dump_arm_unwind): Warn if the table offset is too large.
2015-08-28 H.J. Lu <hongjiu.lu@intel.com>
* Makefile.am (TOOL_PROGS): Add readelf.

14
binutils/readelf.c
View File

@ -7518,7 +7518,10 @@ get_unwind_section_word (struct arm_unw_aux_info * aux,
return FALSE;
/* If the offset is invalid then fail. */
if (word_offset > sec->sh_size - 4)
if (word_offset > (sec->sh_size - 4)
/* PR 18879 */
|| (sec->sh_size < 5 && word_offset >= sec->sh_size)
|| ((bfd_signed_vma) word_offset) < 0)
return FALSE;
/* Get the word at the required offset. */
@ -8301,6 +8304,15 @@ dump_arm_unwind (struct arm_unw_aux_info *aux, Elf_Internal_Shdr *exidx_sec)
{
table_sec = section_headers + entry_addr.section;
table_offset = entry_addr.offset;
/* PR 18879 */
if (table_offset > table_sec->sh_size
|| ((bfd_signed_vma) table_offset) < 0)
{
warn (_("Unwind entry contains corrupt offset (0x%lx) into section %s\n"),
(unsigned long) table_offset,
printable_section_name (table_sec));
continue;
}
}
else
{