From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2124) id 23F223858D32; Mon, 19 Jun 2023 11:09:53 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 23F223858D32 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Nick Clifton To: bfd-cvs@sourceware.org Subject: [binutils-gdb] Fix illegal memory access implementing relocs in a fuzzed x86_64 object file. X-Act-Checkin: binutils-gdb X-Git-Author: Nick Clifton X-Git-Refname: refs/heads/master X-Git-Oldrev: 319626ca736d15836f5381bdc9f0e37396f61b15 X-Git-Newrev: 74d39f70cd9090ba1cdc406421480bb50a864cd2 Message-Id: <20230619110953.23F223858D32@sourceware.org> Date: Mon, 19 Jun 2023 11:09:53 +0000 (GMT) X-BeenThere: binutils-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Jun 2023 11:09:53 -0000 https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D74d39f70cd90= 90ba1cdc406421480bb50a864cd2 commit 74d39f70cd9090ba1cdc406421480bb50a864cd2 Author: Nick Clifton Date: Mon Jun 19 12:09:11 2023 +0100 Fix illegal memory access implementing relocs in a fuzzed x86_64 object= file. =20 PR 30560 * elf64-x86-64.c (elf_x86_64_relocate_section): Add more checks for a= valid relocation offset. Diff: --- bfd/ChangeLog | 6 ++++++ bfd/elf64-x86-64.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 1f9b7ec14ba..4fed6e16874 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,9 @@ +2023-06-19 Nick Clifton + + PR 30560 + * elf64-x86-64.c (elf_x86_64_relocate_section): Add more checks + for a valid relocation offset. + 2023-06-07 Nick Clifton =20 PR 30499 diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c index dd987ee011b..f926464d812 100644 --- a/bfd/elf64-x86-64.c +++ b/bfd/elf64-x86-64.c @@ -3501,6 +3501,9 @@ elf_x86_64_relocate_section (bfd *output_bfd, { bfd_vma roff =3D rel->r_offset; =20 + if (roff >=3D input_section->size) + goto corrupt_input; + BFD_ASSERT (! unresolved_reloc); =20 if (r_type =3D=3D R_X86_64_TLSGD) @@ -3541,6 +3544,8 @@ elf_x86_64_relocate_section (bfd *output_bfd, int largepic =3D 0; if (ABI_64_P (output_bfd)) { + if (roff + 5 >=3D input_section->size) + goto corrupt_input; if (contents[roff + 5] =3D=3D 0xb8) { if (roff < 3 @@ -3576,6 +3581,10 @@ elf_x86_64_relocate_section (bfd *output_bfd, "\x64\x8b\x04\x25\0\0\0\0\x48\x8d\x80\0\0\0", 15); } + + if (roff + 8 + largepic >=3D input_section->size) + goto corrupt_input; + bfd_put_32 (output_bfd, elf_x86_64_tpoff (info, relocation), contents + roff + 8 + largepic); @@ -3633,12 +3642,18 @@ elf_x86_64_relocate_section (bfd *output_bfd, } if (prefix) { + if (roff + 2 >=3D input_section->size) + goto corrupt_input; + bfd_put_8 (output_bfd, 0x0f, contents + roff); bfd_put_8 (output_bfd, 0x1f, contents + roff + 1); bfd_put_8 (output_bfd, 0x00, contents + roff + 2); } else { + if (roff + 1 >=3D input_section->size) + goto corrupt_input; + bfd_put_8 (output_bfd, 0x66, contents + roff); bfd_put_8 (output_bfd, 0x90, contents + roff + 1); }