Fix heap-buffer-overflow error detected by address sanitization on a fuzzed binary.
PR binutils/20794 * readelf.c (process_section_headers): Fix off-by-one error when checking for invalid sh_link and sh_info fields.
This commit is contained in:
parent
93f9a11fbd
commit
cb64e50d42
|
@ -1,3 +1,9 @@
|
|||
2016-11-08 Nick Clifton <nickc@redhat.com>
|
||||
|
||||
PR binutils/20794
|
||||
* readelf.c (process_section_headers): Fix off-by-one error when
|
||||
checking for invalid sh_link and sh_info fields.
|
||||
|
||||
2016-11-04 Andrew Burgess <andrew.burgess@embecosm.com>
|
||||
|
||||
* objcopy.c (copy_section): Add extra calls to free for error
|
||||
|
|
|
@ -5978,7 +5978,7 @@ process_section_headers (FILE * file)
|
|||
case SHT_REL:
|
||||
case SHT_RELA:
|
||||
if (section->sh_link < 1
|
||||
|| section->sh_link > elf_header.e_shnum
|
||||
|| section->sh_link >= elf_header.e_shnum
|
||||
|| (section_headers[section->sh_link].sh_type != SHT_SYMTAB
|
||||
&& section_headers[section->sh_link].sh_type != SHT_DYNSYM))
|
||||
warn (_("[%2u]: Link field (%u) should index a symtab section.\n"),
|
||||
|
@ -5992,7 +5992,7 @@ process_section_headers (FILE * file)
|
|||
case SHT_GNU_verdef:
|
||||
case SHT_GNU_LIBLIST:
|
||||
if (section->sh_link < 1
|
||||
|| section->sh_link > elf_header.e_shnum
|
||||
|| section->sh_link >= elf_header.e_shnum
|
||||
|| section_headers[section->sh_link].sh_type != SHT_STRTAB)
|
||||
warn (_("[%2u]: Link field (%u) should index a string section.\n"),
|
||||
i, section->sh_link);
|
||||
|
@ -6025,7 +6025,7 @@ process_section_headers (FILE * file)
|
|||
case SHT_REL:
|
||||
case SHT_RELA:
|
||||
if (section->sh_info < 1
|
||||
|| section->sh_info > elf_header.e_shnum
|
||||
|| section->sh_info >= elf_header.e_shnum
|
||||
|| (section_headers[section->sh_info].sh_type != SHT_PROGBITS
|
||||
&& section_headers[section->sh_info].sh_type != SHT_NOBITS
|
||||
&& section_headers[section->sh_info].sh_type != SHT_NOTE
|
||||
|
@ -6072,7 +6072,7 @@ process_section_headers (FILE * file)
|
|||
;
|
||||
else if (section->sh_flags & SHF_INFO_LINK)
|
||||
{
|
||||
if (section->sh_info < 1 || section->sh_info > elf_header.e_shnum)
|
||||
if (section->sh_info < 1 || section->sh_info >= elf_header.e_shnum)
|
||||
warn (_("[%2u]: Expected link to another section in info field"), i);
|
||||
}
|
||||
else if (section->sh_type < SHT_LOOS && section->sh_info != 0)
|
||||
|
|
Loading…
Reference in New Issue