FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

readelf memory leaks processing mips

Browse source 
* readelf.c (process_mips_specific): Free eopt and iopt.  Avoid
	possibility of overflow when checking number of conflicts.
This commit is contained in:
Alan Modra 2020-04-14 09:51:44 +09:30
parent fa1477dc34
commit 645f43a80c
2 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
binutils/ChangeLog
View file

@ -1,3 +1,8 @@
2020-04-14 Alan Modra <amodra@gmail.com>
* readelf.c (process_mips_specific): Free eopt and iopt. Avoid
possibility of overflow when checking number of conflicts.
2020-04-14 H.J. Lu <hongjiu.lu@intel.com> 2020-04-14 H.J. Lu <hongjiu.lu@intel.com>
PR binutils/25707 PR binutils/25707

10
binutils/readelf.c
View file

@ -16817,6 +16817,7 @@ process_mips_specific (Filedata * filedata)
if (iopt == NULL) if (iopt == NULL)
{ {
error (_("Out of memory allocating space for MIPS options\n")); error (_("Out of memory allocating space for MIPS options\n"));
free (eopt);
return FALSE; return FALSE;
} }
@ -16839,7 +16840,10 @@ process_mips_specific (Filedata * filedata)
if (option->size < sizeof (* eopt) if (option->size < sizeof (* eopt)
|| offset + option->size > sect->sh_size) || offset + option->size > sect->sh_size)
{ {
error (_("Invalid size (%u) for MIPS option\n"), option->size); error (_("Invalid size (%u) for MIPS option\n"),
option->size);
free (iopt);
free (eopt);
return FALSE; return FALSE;
} }
offset += option->size; offset += option->size;
@ -17033,7 +17037,7 @@ process_mips_specific (Filedata * filedata)
offset += option->size; offset += option->size;
++option; ++option;
} }
free (iopt);
free (eopt); free (eopt);
} }
else else
@ -17053,7 +17057,7 @@ process_mips_specific (Filedata * filedata)
/* PR 21345 - print a slightly more helpful error message /* PR 21345 - print a slightly more helpful error message
if we are sure that the cmalloc will fail. */ if we are sure that the cmalloc will fail. */
if (conflictsno * sizeof (* iconf) > filedata->file_size) if (conflictsno > filedata->file_size / sizeof (* iconf))
{ {
error (_("Overlarge number of conflicts detected: %lx\n"), error (_("Overlarge number of conflicts detected: %lx\n"),
(long) conflictsno); (long) conflictsno);