OpenE2K/binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix excessive memory allocation attempts and possible integer overfloaws when attempting to read a COFF binary with a corrupt symbol count.

Browse Source 
PR 22385
	* coffgen.c (_bfd_coff_get_external_symbols): Check for an
	overlarge raw syment count.
	(coff_get_normalized_symtab): Likewise.
This commit is contained in:
Nick Clifton 2017-11-03 11:55:21 +00:00
parent 8e68731c8a
commit 6cee897971
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bfd/ChangeLog
View File

@ -1,3 +1,11 @@
2017-11-03 Mingi Cho <mgcho.minic@gmail.com>
Nick Clifton <nickc@redhat.com>
PR 22385
* coffgen.c (_bfd_coff_get_external_symbols): Check for an
overlarge raw syment count.
(coff_get_normalized_symtab): Likewise.
2017-11-01 James Bowman <james.bowman@ftdichip.com>
* archures.c: Add bfd_mach_ft32b.

17
bfd/coffgen.c
View File

@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abfd)
size = obj_raw_syment_count (abfd) * symesz;
if (size == 0)
return TRUE;
/* Check for integer overflow and for unreasonable symbol counts. */
if (size < obj_raw_syment_count (abfd)
|| (bfd_get_file_size (abfd) > 0
&& size > bfd_get_file_size (abfd)))
{
_bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
abfd, obj_raw_syment_count (abfd));
return FALSE;
}
syms = bfd_malloc (size);
if (syms == NULL)
{
/* PR 21013: Provide an error message when the alloc fails. */
_bfd_error_handler (_("%B: Not enough memory to allocate space for %Lu symbols"),
abfd, size);
_bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
abfd, obj_raw_syment_count (abfd), symesz);
return FALSE;
}
@ -1794,6 +1804,9 @@ coff_get_normalized_symtab (bfd *abfd)
return NULL;
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
/* Check for integer overflow. */
if (size < obj_raw_syment_count (abfd))
return NULL;
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
if (internal == NULL && size != 0)
return NULL;