FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a stack exhaustion bug parsing malicious STABS format debug information.

Browse source 
PR 28718
	* debug.c (debug_write_type): Allow for malicious recursion via
	indirect debug types.
This commit is contained in:
Nick Clifton 2022-01-06 16:37:26 +00:00
parent 27297937e0
commit af4004d1da
2 changed files with 22 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
binutils/ChangeLog
View file

@ -1,3 +1,9 @@
2022-01-06 Nick Clifton <nickc@redhat.com>
PR 28718
* debug.c (debug_write_type): Allow for malicious recursion via
indirect debug types.
2022-01-04 Nick Clifton <nickc@redhat.com> 2022-01-04 Nick Clifton <nickc@redhat.com>
PR 28716 PR 28716

16
binutils/debug.c
View file

@ -2484,8 +2484,22 @@ debug_write_type (struct debug_handle *info,
debug_error (_("debug_write_type: illegal type encountered")); debug_error (_("debug_write_type: illegal type encountered"));
return false; return false;
case DEBUG_KIND_INDIRECT: case DEBUG_KIND_INDIRECT:
return debug_write_type (info, fns, fhandle, *type->u.kindirect->slot, /* PR 28718: Allow for malicious recursion. */
{
static int recursion_depth = 0;
bool result;
if (recursion_depth > 256)
{
debug_error (_("debug_write_type: too many levels of nested indirection"));
return false;
}
++ recursion_depth;
result = debug_write_type (info, fns, fhandle, *type->u.kindirect->slot,
name); name);
-- recursion_depth;
return result;
}
case DEBUG_KIND_VOID: case DEBUG_KIND_VOID:
return (*fns->void_type) (fhandle); return (*fns->void_type) (fhandle);
case DEBUG_KIND_INT: case DEBUG_KIND_INT: