From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: i386msdos uninitialised read
Date: Mon, 23 Mar 2020 23:28:33 +1030 [thread overview]
Message-ID: <20200323125833.GT4583@bubble.grove.modra.org> (raw)
Also reinstate ld i386aout for i386-msdos target, which doesn't build
otherwise. Maybe the target should disappear?
bfd/
* i386msdos.c (msdos_object_p): Don't access e_lfanew when that
field hasn't been read. Remove unnecessary casts.
ld/
* Makefile.am (ALL_EMULATION_SOURCES): Reinstate ei386aout.c.
Include ei386aout dep file.
* Makefile.in: Regenerate.
* po/BLD-POTFILES.in: Regenerate.
diff --git a/bfd/i386msdos.c b/bfd/i386msdos.c
index 5b56751cd3..e9307a7a42 100644
--- a/bfd/i386msdos.c
+++ b/bfd/i386msdos.c
@@ -47,10 +47,10 @@ msdos_object_p (bfd *abfd)
struct external_DOS_hdr hdr;
bfd_byte buffer[2];
asection *section;
- unsigned int size;
+ bfd_size_type size;
if (bfd_seek (abfd, (file_ptr) 0, SEEK_SET) != 0
- || bfd_bread (&hdr, (bfd_size_type) sizeof (hdr), abfd) < DOS_HDR_SIZE)
+ || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) < DOS_HDR_SIZE)
{
if (bfd_get_error () != bfd_error_system_call)
bfd_set_error (bfd_error_wrong_format);
@@ -67,9 +67,11 @@ msdos_object_p (bfd *abfd)
e_lfanew field will be valid and point to a header beginning with one of
the relevant signatures. If not, e_lfanew might point to anything, so
don't bail if we can't read there. */
- if (H_GET_16 (abfd, hdr.e_cparhdr) < 4
- || bfd_seek (abfd, (file_ptr) H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
- || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
+ if (size < offsetof (struct external_DOS_hdr, e_lfanew) + 4
+ || H_GET_16 (abfd, hdr.e_cparhdr) < 4)
+ ;
+ else if (bfd_seek (abfd, H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
+ || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
{
if (bfd_get_error () == bfd_error_system_call)
return NULL;
@@ -102,7 +104,7 @@ msdos_object_p (bfd *abfd)
size += H_GET_16 (abfd, hdr.e_cblp);
/* Check that the size is valid. */
- if (bfd_seek (abfd, (file_ptr) (section->filepos + size), SEEK_SET) != 0)
+ if (bfd_seek (abfd, section->filepos + size, SEEK_SET) != 0)
{
if (bfd_get_error () != bfd_error_system_call)
bfd_set_error (bfd_error_wrong_format);
diff --git a/ld/Makefile.am b/ld/Makefile.am
index 4a9b8404b7..a64899fc09 100644
--- a/ld/Makefile.am
+++ b/ld/Makefile.am
@@ -312,6 +312,7 @@ ALL_EMULATION_SOURCES = \
ehppalinux.c \
ehppanbsd.c \
ehppaobsd.c \
+ ei386aout.c \
ei386beos.c \
ei386bsd.c \
ei386go32.c \
@@ -800,6 +801,7 @@ $(ALL_EMULATION_SOURCES) $(ALL_64_EMULATION_SOURCES): $(GEN_DEPENDS)
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppalinux.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppanbsd.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppaobsd.Pc@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386aout.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386beos.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386bsd.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386go32.Pc@am__quote@
--
Alan Modra
Australia Development Lab, IBM
next reply other threads:[~2020-03-23 12:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-23 12:58 Alan Modra [this message]
2020-03-26 9:34 ` Alan Modra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200323125833.GT4583@bubble.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).