MatCat.OpenSource/8sa1-binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

som_bfd_fill_in_ar_symbols buffer overflow

Browse Source 
* som.c (som_bfd_fill_in_ar_symbols): Bounds check som_dict index.
This commit is contained in:
Alan Modra 2020-01-06 17:12:51 +10:30
parent 3e6aa7751a
commit 85d8681747
2 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bfd/ChangeLog
View File

@ -1,3 +1,7 @@
2020-01-06 Alan Modra <amodra@gmail.com>
* som.c (som_bfd_fill_in_ar_symbols): Bounds check som_dict index.
2020-01-06 Alan Modra <amodra@gmail.com> 2020-01-06 Alan Modra <amodra@gmail.com>
* mach-o.c (bfd_mach_o_read_dylinker): Don't read past end of * mach-o.c (bfd_mach_o_read_dylinker): Don't read past end of

23
bfd/som.c
View File

@ -6002,6 +6002,7 @@ som_bfd_fill_in_ar_symbols (bfd *abfd,
size_t len; size_t len;
unsigned char ext_len[4]; unsigned char ext_len[4];
char *name; char *name;
unsigned int ndx;
/* An empty chain has zero as it's file offset. */ /* An empty chain has zero as it's file offset. */
hash_val = bfd_getb32 (hash_table + 4 * i); hash_val = bfd_getb32 (hash_table + 4 * i);
@ -6048,9 +6049,14 @@ som_bfd_fill_in_ar_symbols (bfd *abfd,
/* Fill in the file offset. Note that the "location" field points /* Fill in the file offset. Note that the "location" field points
to the SOM itself, not the ar_hdr in front of it. */ to the SOM itself, not the ar_hdr in front of it. */
set->file_offset = ndx = bfd_getb32 (lst_symbol.som_index);
bfd_getb32 (som_dict[bfd_getb32 (lst_symbol.som_index)].location) if (ndx >= lst_header->module_count)
- sizeof (struct ar_hdr); {
bfd_set_error (bfd_error_bad_value);
goto error_return;
}
set->file_offset
= bfd_getb32 (som_dict[ndx].location) - sizeof (struct ar_hdr);
/* Go to the next symbol. */ /* Go to the next symbol. */
set++; set++;
@ -6097,9 +6103,14 @@ som_bfd_fill_in_ar_symbols (bfd *abfd,
/* Fill in the file offset. Note that the "location" field points /* Fill in the file offset. Note that the "location" field points
to the SOM itself, not the ar_hdr in front of it. */ to the SOM itself, not the ar_hdr in front of it. */
set->file_offset = ndx = bfd_getb32 (lst_symbol.som_index);
bfd_getb32 (som_dict[bfd_getb32 (lst_symbol.som_index)].location) if (ndx >= lst_header->module_count)
- sizeof (struct ar_hdr); {
bfd_set_error (bfd_error_bad_value);
goto error_return;
}
set->file_offset
= bfd_getb32 (som_dict[ndx].location) - sizeof (struct ar_hdr);
/* Go on to the next symbol. */ /* Go on to the next symbol. */
set++; set++;