MatCat.OpenSource/8sa1-binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Prevent illegal memory access when processing COFF auxillary symbol information.

Browse Source 
PR 23061
	* coffgen.c (coff_pointerize_aux): Add table_end parameter.  Use
	it to prevent walking off the end of the table.
	(coff_get_normalized_symtab): Pass internal_end pointer to
	coff_pointerize_aux.
This commit is contained in:
Nick Clifton 2018-08-23 11:45:38 +01:00
parent d0abeec8d4
commit 334d4ced42
2 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bfd/ChangeLog
View File

@ -1,3 +1,11 @@
2018-08-23 Nick Clifton <nickc@redhat.com>
PR 23061
* coffgen.c (coff_pointerize_aux): Add table_end parameter. Use
it to prevent walking off the end of the table.
(coff_get_normalized_symtab): Pass internal_end pointer to
coff_pointerize_aux.
2018-08-23 Alan Modra <amodra@gmail.com> 2018-08-23 Alan Modra <amodra@gmail.com>
* elf64-ppc.c (ppc64_elf_relocate_section): Don't miss clearing * elf64-ppc.c (ppc64_elf_relocate_section): Don't miss clearing

13
bfd/coffgen.c
View File

@ -1521,7 +1521,8 @@ coff_pointerize_aux (bfd *abfd,
combined_entry_type *table_base, combined_entry_type *table_base,
combined_entry_type *symbol, combined_entry_type *symbol,
unsigned int indaux, unsigned int indaux,
combined_entry_type *auxent) combined_entry_type *auxent,
combined_entry_type *table_end)
{ {
unsigned int type = symbol->u.syment.n_type; unsigned int type = symbol->u.syment.n_type;
unsigned int n_sclass = symbol->u.syment.n_sclass; unsigned int n_sclass = symbol->u.syment.n_sclass;
@ -1549,16 +1550,20 @@ coff_pointerize_aux (bfd *abfd,
|| n_sclass == C_FCN) || n_sclass == C_FCN)
&& auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0 && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0
&& auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l
< (long) obj_raw_syment_count (abfd)) < (long) obj_raw_syment_count (abfd)
&& table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l
< table_end)
{ {
auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.p = auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.p =
table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l; table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l;
auxent->fix_end = 1; auxent->fix_end = 1;
} }
/* A negative tagndx is meaningless, but the SCO 3.2v4 cc can /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
generate one, so we must be careful to ignore it. */ generate one, so we must be careful to ignore it. */
if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
< obj_raw_syment_count (abfd)) < obj_raw_syment_count (abfd)
&& table_base + auxent->u.auxent.x_sym.x_tagndx.l < table_end)
{ {
auxent->u.auxent.x_sym.x_tagndx.p = auxent->u.auxent.x_sym.x_tagndx.p =
table_base + auxent->u.auxent.x_sym.x_tagndx.l; table_base + auxent->u.auxent.x_sym.x_tagndx.l;
@ -1869,7 +1874,7 @@ coff_get_normalized_symtab (bfd *abfd)
internal_ptr->is_sym = FALSE; internal_ptr->is_sym = FALSE;
coff_pointerize_aux (abfd, internal, symbol_ptr, i, coff_pointerize_aux (abfd, internal, symbol_ptr, i,
internal_ptr); internal_ptr, internal_end);
} }
} }