From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1062) id C8CD63856617; Mon, 5 Jun 2023 07:18:21 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C8CD63856617 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Alan Modra To: bfd-cvs@sourceware.org Subject: [binutils-gdb] Yet another ecoff fuzzed object fix X-Act-Checkin: binutils-gdb X-Git-Author: Alan Modra X-Git-Refname: refs/heads/master X-Git-Oldrev: 5b207b919483f67311a73dfc1de8897ecfd8e776 X-Git-Newrev: 6fc018e9e593a3235dbf7026726ba4665373b741 Message-Id: <20230605071821.C8CD63856617@sourceware.org> Date: Mon, 5 Jun 2023 07:18:21 +0000 (GMT) X-BeenThere: binutils-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Jun 2023 07:18:21 -0000 https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D6fc018e9e593= a3235dbf7026726ba4665373b741 commit 6fc018e9e593a3235dbf7026726ba4665373b741 Author: Alan Modra Date: Mon Jun 5 16:21:25 2023 +0930 Yet another ecoff fuzzed object fix =20 * ecoff.c (_bfd_ecoff_slurp_symbol_table): Sanity check fdr_ptr csym against remaining space for symbols. Error on out of boun= ds fdr_ptr fields. Diff: --- bfd/ecoff.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/bfd/ecoff.c b/bfd/ecoff.c index c4c2e530be0..573f52d0299 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -956,13 +956,19 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd) char *lraw_end; HDRR *symhdr =3D &ecoff_data (abfd)->debug_info.symbolic_header; =20 + if (fdr_ptr->csym =3D=3D 0) + continue; if (fdr_ptr->isymBase < 0 || fdr_ptr->isymBase > symhdr->isymMax - || fdr_ptr->csym <=3D 0 - || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase + || fdr_ptr->csym < 0 + || fdr_ptr->csym > ((long) bfd_get_symcount (abfd) + - (internal_ptr - internal)) || fdr_ptr->issBase < 0 || fdr_ptr->issBase > symhdr->issMax) - continue; + { + bfd_set_error (bfd_error_bad_value); + return false; + } lraw_src =3D ((char *) ecoff_data (abfd)->debug_info.external_sym + fdr_ptr->isymBase * external_sym_size); lraw_end =3D lraw_src + fdr_ptr->csym * external_sym_size;