FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

asan: NULL dereference in bfd_elf_set_group_contents

Browse source 
* elf-bfd.h (struct output_elf_obj_tdata): Make num_section_syms
	unsigned.
	* elf.c (bfd_elf_set_group_contents): Bounds check sec->index
	and check that entry in elf_section_syms for sec is non-NULL.
	(_bfd_elf_symbol_from_bfd_symbol): Adjust.
This commit is contained in:
Alan Modra 2021-12-17 15:41:59 +10:30
parent 7ebf6ed02b
commit 27e3da31c3
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bfd/elf-bfd.h
View file

@ -1914,7 +1914,7 @@ struct output_elf_obj_tdata
/* Linker information. */
struct bfd_link_info *link_info;
int num_section_syms;
unsigned int num_section_syms;
unsigned int shstrtab_section, strtab_section;
/* Segment flags for the PT_GNU_STACK segment. */

10
bfd/elf.c
View file

@ -3501,7 +3501,8 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec, void *failedptrarg)
/* If called from the assembler, swap_out_syms will have set up
elf_section_syms.
PR 25699: A corrupt input file could contain bogus group info. */
if (elf_section_syms (abfd) == NULL)
if (sec->index >= elf_num_section_syms (abfd)
|| elf_section_syms (abfd)[sec->index] == NULL)
{
*failedptr = true;
return;
@ -6764,15 +6765,14 @@ _bfd_elf_symbol_from_bfd_symbol (bfd *abfd, asymbol **asym_ptr_ptr)
&& asym_ptr->section)
{
asection *sec;
int indx;
sec = asym_ptr->section;
if (sec->owner != abfd && sec->output_section != NULL)
sec = sec->output_section;
if (sec->owner == abfd
&& (indx = sec->index) < elf_num_section_syms (abfd)
&& elf_section_syms (abfd)[indx] != NULL)
asym_ptr->udata.i = elf_section_syms (abfd)[indx]->udata.i;
&& sec->index < elf_num_section_syms (abfd)
&& elf_section_syms (abfd)[sec->index] != NULL)
asym_ptr->udata.i = elf_section_syms (abfd)[sec->index]->udata.i;
}
idx = asym_ptr->udata.i;