FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

XCOFF uninitialized read

Browse source 
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Ensure size is large
	enough to read number of symbols.
This commit is contained in:
Alan Modra 2020-03-20 10:57:38 +10:30
parent 340f3ac808
commit 67338173a4
2 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
bfd/ChangeLog
View file

@ -1,3 +1,8 @@
2020-03-20 Alan Modra <amodra@gmail.com>
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Ensure size is large
enough to read number of symbols.
2020-03-20 Alan Modra <amodra@gmail.com> 2020-03-20 Alan Modra <amodra@gmail.com>
* elf.c (_bfd_elf_setup_sections): Don't test known non-NULL * elf.c (_bfd_elf_setup_sections): Don't test known non-NULL

8
bfd/coff-rs6000.c
View file

@ -1260,9 +1260,9 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
return FALSE; return FALSE;
GET_VALUE_IN_FIELD (sz, hdr.size, 10); GET_VALUE_IN_FIELD (sz, hdr.size, 10);
if (sz == (bfd_size_type) -1) if (sz + 1 < 5)
{ {
bfd_set_error (bfd_error_no_memory); bfd_set_error (bfd_error_bad_value);
return FALSE; return FALSE;
} }
@ -1322,9 +1322,9 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
return FALSE; return FALSE;
GET_VALUE_IN_FIELD (sz, hdr.size, 10); GET_VALUE_IN_FIELD (sz, hdr.size, 10);
if (sz == (bfd_size_type) -1) if (sz + 1 < 9)
{ {
bfd_set_error (bfd_error_no_memory); bfd_set_error (bfd_error_bad_value);
return FALSE; return FALSE;
} }