Fix excessive memory allocation attempts and possible integer overfloaws when attempting to read a COFF binary with a corrupt symbol count.
PR 22385 * coffgen.c (_bfd_coff_get_external_symbols): Check for an overlarge raw syment count. (coff_get_normalized_symtab): Likewise.
This commit is contained in:
parent
8e68731c8a
commit
6cee897971
|
@ -1,3 +1,11 @@
|
||||||
|
2017-11-03 Mingi Cho <mgcho.minic@gmail.com>
|
||||||
|
Nick Clifton <nickc@redhat.com>
|
||||||
|
|
||||||
|
PR 22385
|
||||||
|
* coffgen.c (_bfd_coff_get_external_symbols): Check for an
|
||||||
|
overlarge raw syment count.
|
||||||
|
(coff_get_normalized_symtab): Likewise.
|
||||||
|
|
||||||
2017-11-01 James Bowman <james.bowman@ftdichip.com>
|
2017-11-01 James Bowman <james.bowman@ftdichip.com>
|
||||||
|
|
||||||
* archures.c: Add bfd_mach_ft32b.
|
* archures.c: Add bfd_mach_ft32b.
|
||||||
|
|
|
@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abfd)
|
||||||
size = obj_raw_syment_count (abfd) * symesz;
|
size = obj_raw_syment_count (abfd) * symesz;
|
||||||
if (size == 0)
|
if (size == 0)
|
||||||
return TRUE;
|
return TRUE;
|
||||||
|
/* Check for integer overflow and for unreasonable symbol counts. */
|
||||||
|
if (size < obj_raw_syment_count (abfd)
|
||||||
|
|| (bfd_get_file_size (abfd) > 0
|
||||||
|
&& size > bfd_get_file_size (abfd)))
|
||||||
|
|
||||||
|
{
|
||||||
|
_bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
|
||||||
|
abfd, obj_raw_syment_count (abfd));
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
syms = bfd_malloc (size);
|
syms = bfd_malloc (size);
|
||||||
if (syms == NULL)
|
if (syms == NULL)
|
||||||
{
|
{
|
||||||
/* PR 21013: Provide an error message when the alloc fails. */
|
/* PR 21013: Provide an error message when the alloc fails. */
|
||||||
_bfd_error_handler (_("%B: Not enough memory to allocate space for %Lu symbols"),
|
_bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
|
||||||
abfd, size);
|
abfd, obj_raw_syment_count (abfd), symesz);
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1794,6 +1804,9 @@ coff_get_normalized_symtab (bfd *abfd)
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|
||||||
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
|
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
|
||||||
|
/* Check for integer overflow. */
|
||||||
|
if (size < obj_raw_syment_count (abfd))
|
||||||
|
return NULL;
|
||||||
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
|
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
|
||||||
if (internal == NULL && size != 0)
|
if (internal == NULL && size != 0)
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|
Loading…
Reference in New Issue