FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a use-after-free bug in the BFD library when scanning a corrupt ELF file.

Browse source 
PR 26005
	* elf.c (bfd_section_from_shdr): Use bfd_malloc to allocate memory
	for the sections_being_created array.
This commit is contained in:
Nick Clifton 2020-05-18 15:52:03 +01:00
parent 1d72769534
commit ed02cdb5b7
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bfd/ChangeLog
View file

@ -1,3 +1,9 @@
2020-05-18 Nick Clifton <nickc@redhat.com>
PR 26005
* elf.c (bfd_section_from_shdr): Use bfd_malloc to allocate memory
for the sections_being_created array.
2020-05-18 Alan Modra <amodra@gmail.com>
* ecoff.c (ecoff_slurp_reloc_table): Malloc external_relocs so

9
bfd/elf.c
View file

@ -2071,7 +2071,11 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
if (sections_being_created == NULL)
{
size_t amt = elf_numsections (abfd) * sizeof (bfd_boolean);
sections_being_created = (bfd_boolean *) bfd_zalloc (abfd, amt);
/* PR 26005: Do not use bfd_zalloc here as the memory might
be released before the bfd has been fully scanned. */
sections_being_created = (bfd_boolean *) bfd_malloc (amt);
memset (sections_being_created, FALSE, amt);
if (sections_being_created == NULL)
return FALSE;
sections_being_created_abfd = abfd;
@ -2611,8 +2615,9 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
sections_being_created [shindex] = FALSE;
if (-- nesting == 0)
{
free (sections_being_created);
sections_being_created = NULL;
sections_being_created_abfd = abfd;
sections_being_created_abfd = NULL;
}
return ret;
}