yggdrasil/binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

PR25961, buffer overflow in coff_swap_aux_in

Browse Source 
PR 25961
	* coffgen.c (coff_get_normalized_symtab): Check that buffer
	contains required number of auxents before processing any auxent.
	* coffswap.h (coff_swap_aux_in <C_FILE>): Only swap in extended
	file name from auxents for PE.
This commit is contained in:
Alan Modra 2020-05-11 18:00:31 +09:30
parent b59cca2581
commit 4d5acb1ea5
3 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bfd/ChangeLog
View File

@ -1,3 +1,11 @@
2020-05-11 Alan Modra <amodra@gmail.com>
PR 25961
* coffgen.c (coff_get_normalized_symtab): Check that buffer
contains required number of auxents before processing any auxent.
* coffswap.h (coff_swap_aux_in <C_FILE>): Only swap in extended
file name from auxents for PE.
2020-05-04 Gunther Nikl <gnikl@justmail.de>
* aout-cris.c (DEFAULT_ARCH): Delete define.

14
bfd/coffgen.c
View File

@ -1818,6 +1818,13 @@ coff_get_normalized_symtab (bfd *abfd)
symbol_ptr = internal_ptr;
internal_ptr->is_sym = TRUE;
/* PR 17512: Prevent buffer overrun. */
if (symbol_ptr->u.syment.n_numaux > (raw_end - raw_src) / symesz)
{
bfd_release (abfd, internal);
return NULL;
}
for (i = 0;
i < symbol_ptr->u.syment.n_numaux;
i++)
@ -1825,13 +1832,6 @@ coff_get_normalized_symtab (bfd *abfd)
internal_ptr++;
raw_src += symesz;
/* PR 17512: Prevent buffer overrun. */
if (raw_src >= raw_end || internal_ptr >= internal_end)
{
bfd_release (abfd, internal);
return NULL;
}
bfd_coff_swap_aux_in (abfd, (void *) raw_src,
symbol_ptr->u.syment.n_type,
symbol_ptr->u.syment.n_sclass,

2
bfd/coffswap.h
View File

@ -399,7 +399,7 @@ coff_swap_aux_in (bfd *abfd,
#if FILNMLEN != E_FILNMLEN
#error we need to cope with truncating or extending FILNMLEN
#else
if (numaux > 1)
if (numaux > 1 && coff_data (abfd)->pe)
{
if (indx == 0)
memcpy (in->x_file.x_fname, ext->x_file.x_fname,