FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix illegal memory access when parsing a corrupt PE format file.

Browse source 
PR 27795
	* coff-rs6000.c (_bfd_xcoff_read_ar_hdr): Check for invalid name
	lengths.
This commit is contained in:
Nick Clifton 2021-04-30 12:11:35 +01:00
parent 5536f0cc62
commit bceb87ef4d
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bfd/ChangeLog
View file

@ -1,3 +1,9 @@
2021-04-30 Nick Clifton <nickc@redhat.com>
PR 27795
* coff-rs6000.c (_bfd_xcoff_read_ar_hdr): Check for invalid name
lengths.
2021-04-29 Nick Clifton <nickc@redhat.com>
PR 27793

4
bfd/coff-rs6000.c
View file

@ -1619,6 +1619,8 @@ _bfd_xcoff_read_ar_hdr (bfd *abfd)
return NULL;
GET_VALUE_IN_FIELD (namlen, hdr.namlen, 10);
if (namlen > bfd_get_file_size (abfd))
return NULL;
amt = sizeof (struct areltdata) + SIZEOF_AR_HDR + namlen + 1;
ret = (struct areltdata *) bfd_malloc (amt);
if (ret == NULL)
@ -1646,6 +1648,8 @@ _bfd_xcoff_read_ar_hdr (bfd *abfd)
return NULL;
GET_VALUE_IN_FIELD (namlen, hdr.namlen, 10);
if (namlen > bfd_get_file_size (abfd))
return NULL;
amt = sizeof (struct areltdata) + SIZEOF_AR_HDR_BIG + namlen + 1;
ret = (struct areltdata *) bfd_malloc (amt);
if (ret == NULL)