FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent a seg-fault in the linker when accessing a specially crafted, corrupt, aout binary.

Browse source 
PR ld/19629
	* aoutx.h (aout_link_add_symbols): Check for out of range string
	table offsets.
This commit is contained in:
Nick Clifton 2016-02-19 15:55:06 +00:00
parent 737684142b
commit e517df3dbf
2 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
bfd/ChangeLog
View file

@ -1,5 +1,9 @@
2016-02-19 Nick Clifton <nickc@redhat.com>
PR ld/19629
* aoutx.h (aout_link_add_symbols): Check for out of range string
table offsets.
PR ld/19628
* reloc.c (bfd_generic_get_relocated_section_contents): Stop
processing if we encounter a reloc without an associated symbol.

10
bfd/aoutx.h
View file

@ -3002,7 +3002,11 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
if ((type & N_STAB) != 0)
continue;
/* PR 19629: Corrupt binaries can contain illegal string offsets. */
if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
return FALSE;
name = strings + GET_WORD (abfd, p->e_strx);
value = GET_WORD (abfd, p->e_value);
flags = BSF_GLOBAL;
string = NULL;
@ -3060,6 +3064,9 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
which this one really is. */
BFD_ASSERT (p + 1 < pend);
++p;
/* PR 19629: Corrupt binaries can contain illegal string offsets. */
if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
return FALSE;
string = strings + GET_WORD (abfd, p->e_strx);
section = bfd_ind_section_ptr;
flags |= BSF_INDIRECT;
@ -3093,6 +3100,9 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
return TRUE;
++p;
string = name;
/* PR 19629: Corrupt binaries can contain illegal string offsets. */
if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
return FALSE;
name = strings + GET_WORD (abfd, p->e_strx);
section = bfd_und_section_ptr;
flags |= BSF_WARNING;