yggdrasil/binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

asan: heap buffer overflow in _bfd_mips_elf_section_from_shdr

Browse Source 
* elfxx-mips.c (_bfd_mips_elf_section_from_shdr): Sanity check
	intopt.size and remaining bytes in section for reginfo.
This commit is contained in:
Alan Modra
2022-06-03 22:47:50 +09:30
parent 7e6ba6a2a5
commit 3dc8d5eada
1 changed files with 32 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bfd/elfxx-mips.c
+32 -23
View File
@@ -7542,34 +7542,43 @@ _bfd_mips_elf_section_from_shdr (bfd *abfd,
&intopt);
if (intopt.size < sizeof (Elf_External_Options))
{
bad_opt:
_bfd_error_handler
/* xgettext:c-format */
(_("%pB: warning: bad `%s' option size %u smaller than"
" its header"),
abfd, MIPS_ELF_OPTIONS_SECTION_NAME (abfd), intopt.size);
(_("%pB: warning: truncated `%s' option"),
abfd, MIPS_ELF_OPTIONS_SECTION_NAME (abfd));
break;
}
if (ABI_64_P (abfd) && intopt.kind == ODK_REGINFO)
if (intopt.kind == ODK_REGINFO)
{
Elf64_Internal_RegInfo intreg;
bfd_mips_elf64_swap_reginfo_in
(abfd,
((Elf64_External_RegInfo *)
(l + sizeof (Elf_External_Options))),
&intreg);
elf_gp (abfd) = intreg.ri_gp_value;
}
else if (intopt.kind == ODK_REGINFO)
{
Elf32_RegInfo intreg;
bfd_mips_elf32_swap_reginfo_in
(abfd,
((Elf32_External_RegInfo *)
(l + sizeof (Elf_External_Options))),
&intreg);
elf_gp (abfd) = intreg.ri_gp_value;
if (ABI_64_P (abfd))
{
Elf64_Internal_RegInfo intreg;
size_t needed = (sizeof (Elf_External_Options)
+ sizeof (Elf64_External_RegInfo));
if (intopt.size < needed || (size_t) (lend - l) < needed)
goto bad_opt;
bfd_mips_elf64_swap_reginfo_in
(abfd,
((Elf64_External_RegInfo *)
(l + sizeof (Elf_External_Options))),
&intreg);
elf_gp (abfd) = intreg.ri_gp_value;
}
else
{
Elf32_RegInfo intreg;
size_t needed = (sizeof (Elf_External_Options)
+ sizeof (Elf32_External_RegInfo));
if (intopt.size < needed || (size_t) (lend - l) < needed)
goto bad_opt;
bfd_mips_elf32_swap_reginfo_in
(abfd,
((Elf32_External_RegInfo *)
(l + sizeof (Elf_External_Options))),
&intreg);
elf_gp (abfd) = intreg.ri_gp_value;
}
}
l += intopt.size;
}