FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Re: PE objdump -x

Browse source 
All of these buffer overrun tests are better written as a comparison
against size remaining, due to ISO C 9899 standard 6.5.2 para 8
regarding adding a constant to a pointer:

"If both the pointer operand and the result point to elements of the
same array object, or one past the last element of the array object,
the evaluation shall not produce an overflow; otherwise, the behavior
is undefined."

So "ex_dta + 4" might be undefined behaviour, if you interpret "the
array object" in this case to be the malloc'd section contents!

	* pei-x86_64.c (pex64_get_unwind_info): Tidy sanity checks.
	(pex64_xdata_print_uwd_codes): Likewise.
This commit is contained in:
Alan Modra 2022-08-03 15:06:15 +09:30
parent 5844ccaac7
commit ecfc6ddb80
1 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

29
bfd/pei-x86_64.c
View file

@ -109,7 +109,7 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,
memset (ui, 0, sizeof (struct pex64_unwind_info));
if (ex_dta >= ex_dta_end || ex_dta + 4 > ex_dta_end)
if (ex_dta_end - ex_dta < 4)
return false;
ui->Version = PEX64_UWI_VERSION (ex_ui->Version_Flags);
@ -123,14 +123,14 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,
ui->rawUnwindCodes = ex_dta + 4;
ui->rawUnwindCodesEnd = ex_dta_end;
ex_dta += ui->SizeOfBlock;
if (ex_dta > ex_dta_end)
if ((size_t) (ex_dta_end - ex_dta) < ui->SizeOfBlock)
return false;
ex_dta += ui->SizeOfBlock;
switch (ui->Flags)
{
case UNW_FLAG_CHAININFO:
if (ex_dta + 12 > ex_dta_end)
if (ex_dta_end - ex_dta < 12)
return false;
ui->rva_BeginAddress = bfd_get_32 (abfd, ex_dta + 0);
ui->rva_EndAddress = bfd_get_32 (abfd, ex_dta + 4);
@ -140,7 +140,7 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,
case UNW_FLAG_EHANDLER:
case UNW_FLAG_UHANDLER:
case UNW_FLAG_FHANDLER:
if (ex_dta + 4 > ex_dta_end)
if (ex_dta_end - ex_dta < 4)
return false;
ui->rva_ExceptionHandler = bfd_get_32 (abfd, ex_dta);
ui->SizeOfBlock += 4;
@ -172,7 +172,8 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
i = 0;
if (ui->rawUnwindCodes + ui->CountOfCodes * 2 > ui->rawUnwindCodesEnd)
if ((size_t) (ui->rawUnwindCodesEnd - ui->rawUnwindCodes)
< ui->CountOfCodes * 2)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -226,7 +227,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
case UWOP_ALLOC_LARGE:
if (info == 0)
{
if (dta + 4 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 4)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -236,7 +237,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
}
else
{
if (dta + 6 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 6)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -261,7 +262,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
break;
case UWOP_SAVE_NONVOL:
if (dta + 4 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 4)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -273,7 +274,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
break;
case UWOP_SAVE_NONVOL_FAR:
if (dta + 6 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 6)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -287,7 +288,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
case UWOP_SAVE_XMM:
if (ui->Version == 1)
{
if (dta + 4 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 4)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -305,7 +306,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
break;
case UWOP_SAVE_XMM_FAR:
if (dta + 6 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 6)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -317,7 +318,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
break;
case UWOP_SAVE_XMM128:
if (dta + 4 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 4)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
@ -329,7 +330,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
break;
case UWOP_SAVE_XMM128_FAR:
if (dta + 6 > ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodesEnd - dta < 6)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;