xcoff slurp_armap bounds checking
"count * 8 >= size" might overflow, "count >= size / 8" doesn't. * coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when checking symbol count against section size. Guard against strlen running off end of buffer by allocating one more byte and zeroing. * coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
This commit is contained in:
parent
f00901886d
commit
228c8f4be0
|
@ -1,3 +1,10 @@
|
|||
2019-12-18 Alan Modra <amodra@gmail.com>
|
||||
|
||||
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when
|
||||
checking symbol count against section size. Guard against strlen
|
||||
running off end of buffer by allocating one more byte and zeroing.
|
||||
* coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
|
||||
|
||||
2019-12-18 Alan Modra <amodra@gmail.com>
|
||||
|
||||
* elf32-ppc.c (ppc_elf_get_synthetic_symtab): Use size_t for vars.
|
||||
|
|
|
@ -1260,18 +1260,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
|
|||
return FALSE;
|
||||
|
||||
GET_VALUE_IN_FIELD (sz, hdr.size, 10);
|
||||
if (sz == (bfd_size_type) -1)
|
||||
{
|
||||
bfd_set_error (bfd_error_no_memory);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/* Read in the entire symbol table. */
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz);
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
|
||||
if (contents == NULL)
|
||||
return FALSE;
|
||||
if (bfd_bread (contents, sz, abfd) != sz)
|
||||
return FALSE;
|
||||
|
||||
/* Ensure strings are NULL terminated so we don't wander off the
|
||||
end of the buffer. */
|
||||
contents[sz] = 0;
|
||||
|
||||
/* The symbol table starts with a four byte count. */
|
||||
c = H_GET_32 (abfd, contents);
|
||||
|
||||
if (c * 4 >= sz)
|
||||
if (c >= sz / 4)
|
||||
{
|
||||
bfd_set_error (bfd_error_bad_value);
|
||||
return FALSE;
|
||||
|
@ -1315,18 +1324,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
|
|||
return FALSE;
|
||||
|
||||
GET_VALUE_IN_FIELD (sz, hdr.size, 10);
|
||||
if (sz == (bfd_size_type) -1)
|
||||
{
|
||||
bfd_set_error (bfd_error_no_memory);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/* Read in the entire symbol table. */
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz);
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
|
||||
if (contents == NULL)
|
||||
return FALSE;
|
||||
if (bfd_bread (contents, sz, abfd) != sz)
|
||||
return FALSE;
|
||||
|
||||
/* Ensure strings are NULL terminated so we don't wander off the
|
||||
end of the buffer. */
|
||||
contents[sz] = 0;
|
||||
|
||||
/* The symbol table starts with an eight byte count. */
|
||||
c = H_GET_64 (abfd, contents);
|
||||
|
||||
if (c * 8 >= sz)
|
||||
if (c >= sz / 8)
|
||||
{
|
||||
bfd_set_error (bfd_error_bad_value);
|
||||
return FALSE;
|
||||
|
|
|
@ -1933,18 +1933,27 @@ xcoff64_slurp_armap (bfd *abfd)
|
|||
return FALSE;
|
||||
|
||||
sz = bfd_scan_vma (hdr.size, (const char **) NULL, 10);
|
||||
if (sz == (bfd_size_type) -1)
|
||||
{
|
||||
bfd_set_error (bfd_error_no_memory);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/* Read in the entire symbol table. */
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz);
|
||||
contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
|
||||
if (contents == NULL)
|
||||
return FALSE;
|
||||
if (bfd_bread (contents, sz, abfd) != sz)
|
||||
return FALSE;
|
||||
|
||||
/* Ensure strings are NULL terminated so we don't wander off the end
|
||||
of the buffer. */
|
||||
contents[sz] = 0;
|
||||
|
||||
/* The symbol table starts with an eight byte count. */
|
||||
c = H_GET_64 (abfd, contents);
|
||||
|
||||
if (c * 8 >= sz)
|
||||
if (c >= sz / 8)
|
||||
{
|
||||
bfd_set_error (bfd_error_bad_value);
|
||||
return FALSE;
|
||||
|
|
Loading…
Reference in New Issue