OpenE2K
/
binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix buffer read overrun by ensuring that DWARF sections containing strings always end in a NUL byte. 

PR 22047
	* dwarf2.c (read_section): If necessary add a terminating NUL byte
	to dwarf string sections.
This commit is contained in:
Nick Clifton 2017-08-31 17:03:23 +01:00
parent b55f3386e4
commit e4f2723003
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2017-08-31 Nick Clifton <nickc@redhat.com>
PR 22047
* dwarf2.c (read_section): If necessary add a terminating NUL byte
to dwarf string sections.
2017-08-31 Alan Modra <amodra@gmail.com>
* po/SRC-POTFILES.in: Regenerate.

23
bfd/dwarf2.c
View File

@ -566,6 +566,29 @@ read_section (bfd * abfd,
0, *section_size))
return FALSE;
}
/* Paranoia - if we are reading in a string section, make sure that it
is NUL terminated. This is to prevent string functions from running
off the end of the buffer. Note - knowing the size of the buffer is
not enough as some functions, eg strchr, do not have a range limited
equivalent.
FIXME: We ought to use a flag in the dwarf_debug_sections[] table to
determine the nature of a debug section, rather than checking the
section name as we do here. */
if (*section_size > 0
&& (*section_buffer)[*section_size - 1] != 0
&& (strstr (section_name, "_str") || strstr (section_name, "names")))
{
bfd_byte * new_buffer = malloc (*section_size + 1);
_bfd_error_handler (_("warning: dwarf string section '%s' is not NUL terminated"),
section_name);
memcpy (new_buffer, *section_buffer, *section_size);
new_buffer[*section_size] = 0;
free (*section_buffer);
*section_buffer = new_buffer;
}
}
/* It is possible to get a bad value for the offset into the section