Fix buffer overrun when parsing an ELF attribute string that is not NUL terminated.
PR 22058 * elf-attrs.c (_bfd_elf_parse_attributes): Ensure that the attribute buffer is NUL terminated.
This commit is contained in:
parent
5c811d30d1
commit
2a143b99fc
|
@ -1,3 +1,9 @@
|
|||
2017-09-01 Nick Clifton <nickc@redhat.com>
|
||||
|
||||
PR 22058
|
||||
* elf-attrs.c (_bfd_elf_parse_attributes): Ensure that the
|
||||
attribute buffer is NUL terminated.
|
||||
|
||||
2017-08-31 Nick Clifton <nickc@redhat.com>
|
||||
|
||||
PR 22047
|
||||
|
|
|
@ -438,7 +438,7 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
|
|||
/* PR 17512: file: 2844a11d. */
|
||||
if (hdr->sh_size == 0)
|
||||
return;
|
||||
contents = (bfd_byte *) bfd_malloc (hdr->sh_size);
|
||||
contents = (bfd_byte *) bfd_malloc (hdr->sh_size + 1);
|
||||
if (!contents)
|
||||
return;
|
||||
if (!bfd_get_section_contents (abfd, hdr->bfd_section, contents, 0,
|
||||
|
@ -447,6 +447,8 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
|
|||
free (contents);
|
||||
return;
|
||||
}
|
||||
/* Ensure that the buffer is NUL terminated. */
|
||||
contents[hdr->sh_size] = 0;
|
||||
p = contents;
|
||||
p_end = p + hdr->sh_size;
|
||||
std_sec = get_elf_backend_data (abfd)->obj_attrs_vendor;
|
||||
|
|
Loading…
Reference in New Issue