public inbox for binutils-cvs@sourceware.org
 help / color / mirror / Atom feed
* [binutils-gdb] bfd_close_all_done bug and bfd_last_cache
@ 2023-08-21 10:43 Alan Modra
  0 siblings, 0 replies; only message in thread
From: Alan Modra @ 2023-08-21 10:43 UTC (permalink / raw)
  To: bfd-cvs

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=fa62aafb7d81b89d68752e830a757ef4199d0b21

commit fa62aafb7d81b89d68752e830a757ef4199d0b21
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Aug 21 18:38:08 2023 +0930

    bfd_close_all_done bug and bfd_last_cache
    
    bfd_close ought to always call iovec->bclose so that cache_bclose is
    called.  If not, bfd_last_cache will be left pointing at freed memory.
    This bug was found by oss-fuzz with the trigger being an old bug in
    the ia64-vms support.  Given a file of the "wrong" size,
    elf64_vms_close_and_cleanup attempted to extend it, leading to an
    error since the file was opened read-only by nm.  nm bad_file bad_file
    then hit the use-after-free when opening the second file.
    
    commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and
    bfd_close_all_done, but didn't go quite far enough.
    
            * elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't
            attempt to extend read-only files.
            * opncls.c (bfd_close_all_done): Always call _close_and_cleanup.
    
    An old bug in the ia64-vms support can be used to tickle another bug
    in bfd_close_all_done.  If _close_and_cleanup returns an error,

Diff:
---
 bfd/elf64-ia64-vms.c |  3 ++-
 bfd/opncls.c         | 10 ++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/bfd/elf64-ia64-vms.c b/bfd/elf64-ia64-vms.c
index f8e9922fc4a..ab1f18b8d81 100644
--- a/bfd/elf64-ia64-vms.c
+++ b/bfd/elf64-ia64-vms.c
@@ -4713,7 +4713,8 @@ static bool
 elf64_vms_close_and_cleanup (bfd *abfd)
 {
   bool ret = true;
-  if (bfd_get_format (abfd) == bfd_object)
+  if (bfd_get_format (abfd) == bfd_object
+      && bfd_write_p (abfd))
     {
       long isize;
 
diff --git a/bfd/opncls.c b/bfd/opncls.c
index 56a90046b1a..741d20e81da 100644
--- a/bfd/opncls.c
+++ b/bfd/opncls.c
@@ -920,13 +920,11 @@ bfd_close_all_done (bfd *abfd)
 {
   bool ret = BFD_SEND (abfd, _close_and_cleanup, (abfd));
 
-  if (ret && abfd->iovec != NULL)
-    {
-      ret = abfd->iovec->bclose (abfd) == 0;
+  if (abfd->iovec != NULL)
+    ret &= abfd->iovec->bclose (abfd) == 0;
 
-      if (ret)
-	_maybe_make_executable (abfd);
-    }
+  if (ret)
+    _maybe_make_executable (abfd);
 
   _bfd_delete_bfd (abfd);
   free (_bfd_error_buf);

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2023-08-21 10:43 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-21 10:43 [binutils-gdb] bfd_close_all_done bug and bfd_last_cache Alan Modra

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).