OpenE2K/binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Large memory allocation reading fuzzed 64-bit archive

Browse Source 
This patch adds a sanity check for the size of an armap.

	* archive64.c (_bfd_archive_64_bit_slurp_armap): Check parsed_size
	against file size before allocating memory.  Use bfd_alloc rather
	than bfd_zalloc for carsym/strings memory.
This commit is contained in:
Alan Modra 2020-03-05 09:42:41 +10:30
parent 8a7adb414e
commit 6f8f95b4c4
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2020-03-05 Alan Modra <amodra@gmail.com>
* archive64.c (_bfd_archive_64_bit_slurp_armap): Check parsed_size
against file size before allocating memory. Use bfd_alloc rather
than bfd_zalloc for carsym/strings memory.
2020-03-04 Alan Modra <amodra@gmail.com>
* elf.c (elf_fake_sections): Ensure sh_addralign is such that

10
bfd/archive64.c
View File

@ -47,6 +47,7 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)
bfd_byte *raw_armap = NULL;
carsym *carsyms;
bfd_size_type amt;
ufile_ptr filesize;
ardata->symdefs = NULL;
@ -76,6 +77,13 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)
parsed_size = mapdata->parsed_size;
free (mapdata);
filesize = bfd_get_file_size (abfd);
if (filesize != 0 && parsed_size > filesize)
{
bfd_set_error (bfd_error_malformed_archive);
return FALSE;
}
if (bfd_bread (int_buf, 8, abfd) != 8)
{
if (bfd_get_error () != bfd_error_system_call)
@ -102,7 +110,7 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)
bfd_set_error (bfd_error_malformed_archive);
return FALSE;
}
ardata->symdefs = (struct carsym *) bfd_zalloc (abfd, amt);
ardata->symdefs = (struct carsym *) bfd_alloc (abfd, amt);
if (ardata->symdefs == NULL)
return FALSE;
carsyms = ardata->symdefs;