yggdrasil/binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixes for memory access violations triggered by running readelf on fuzzed binaries.

Browse Source 
PR binutils/17531
	* dwarf.c (display_debug_aranges): Add check for an excessive
	ar_length value.
	(process_cu_tu_index): Check for a row * columns sum being too
	large.
This commit is contained in:
Nick Clifton 2015-02-13 14:17:18 +00:00
parent 951eaaec17
commit ffc0f143c7
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
binutils/ChangeLog
View File

@ -8,6 +8,12 @@
available before parsing.
(prescan): Likewise.
PR binutils/17531
* dwarf.c (display_debug_aranges): Add check for an excessive
ar_length value.
(process_cu_tu_index): Check for a row * columns sum being too
large.
2015-02-13 Alan Modra <amodra@gmail.com>
* dwarf.c: Formatting, whitespace.

17
binutils/dwarf.c
View File

@ -4923,7 +4923,13 @@ display_debug_aranges (struct dwarf_section *section,
if (excess)
addr_ranges += (2 * address_size) - excess;
start += arange.ar_length + initial_length_size;
hdrptr = start + arange.ar_length + initial_length_size;
if (hdrptr < start || hdrptr > end)
{
error (_("Excessive header length: %lx\n"), (long) arange.ar_length);
break;
}
start = hdrptr;
while (addr_ranges + 2 * address_size <= start)
{
@ -7084,7 +7090,14 @@ process_cu_tu_index (struct dwarf_section *section, int do_display)
memcpy (&this_set[row - 1].signature, ph, sizeof (uint64_t));
prow = poffsets + (row - 1) * ncols * 4;
/* PR 17531: file: b8ce60a8. */
if (prow < poffsets || prow > limit)
{
warn (_("Row index (%u) * num columns (%u) > space remaining in section\n"),
row, ncols);
return 0;
}
if (do_display)
printf (_(" [%3d] 0x%s"),
i, dwarf_vmatoa64 (signature_high, signature_low,