From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by sourceware.org (Postfix) with ESMTPS id 5B2413898C45 for ; Mon, 23 Mar 2020 12:59:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 5B2413898C45 Received: by mail-pl1-x62c.google.com with SMTP id x1so1864300plm.4 for ; Mon, 23 Mar 2020 05:59:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=IsU+L33kfDem+1Rt9RwWFEIzHlr4RSfwSwG7ljMqck8=; b=cq3eRdMXEZjk4PKtPnxmNjyUBLN2wUIPanpOCGey4pdq5voo4ZjEnF3ggimEVnSccT sLI+9pB75x2eeLAZI35vdlitgTByWJMOBgchBGHQqqMMBoD6vrDAiuFJdvcyKREG3W0w nmj9nXYy8U+wmomyPwuPMImY5+JXPthKPZMCN9hibRlTDf8IREIdzk8P1Mj4UDqAvL3u X7CWn7VuYvhVFqiAwkn7oshoNi0kJcPynrtScJoVXPA6tzWGy1oNMdFdT0xUCRzuFWPm 0fW+0VA5OyUdbjVBpQygvhJSgiaDiLgM+jPP6zJCLF5vLlZqXRvtI+k6ZC+m83qrvhk1 8o6g== X-Gm-Message-State: ANhLgQ1i650mKC/RJkfxMDT7DxaNCwc85dkJSHL5CLc7BJY6afyk4XOe sLWQFG6NhJpHMjG/yhlpfhGN/9Px0gU= X-Google-Smtp-Source: ADFU+vsaUn0agGIk8A2hvS6Nvb05h+/YgojWv+oHJ5MexxznN39zDU8tm5nsz0ju+HczBFOVHsgTbg== X-Received: by 2002:a17:902:6acc:: with SMTP id i12mr21496459plt.87.1584968358244; Mon, 23 Mar 2020 05:59:18 -0700 (PDT) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id q43sm12724395pjc.40.2020.03.23.05.59.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Mar 2020 05:59:17 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 2E605806BF; Mon, 23 Mar 2020 23:29:14 +1030 (ACDT) Date: Mon, 23 Mar 2020 23:29:14 +1030 From: Alan Modra To: binutils@sourceware.org Subject: ECOFF archive uninitialised read Message-ID: <20200323125914.GU4583@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-29.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2020 12:59:20 -0000 * ecoff.c (_bfd_ecoff_slurp_armap): Sanity check parsed_size and symbol count. Allocate an extra byte to ensure name strings are terminated. Sanity check name offsets. Release memory on error return. diff --git a/bfd/ecoff.c b/bfd/ecoff.c index ce8eb89a57..50a133b7ba 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -2883,7 +2883,7 @@ _bfd_ecoff_slurp_armap (bfd *abfd) char nextname[17]; unsigned int i; struct areltdata *mapdata; - bfd_size_type parsed_size; + bfd_size_type parsed_size, stringsize; char *raw_armap; struct artdata *ardata; unsigned int count; @@ -2895,9 +2895,9 @@ _bfd_ecoff_slurp_armap (bfd *abfd) /* Get the name of the first element. */ i = bfd_bread ((void *) nextname, (bfd_size_type) 16, abfd); if (i == 0) - return TRUE; + return TRUE; if (i != 16) - return FALSE; + return FALSE; if (bfd_seek (abfd, (file_ptr) -16, SEEK_CUR) != 0) return FALSE; @@ -2942,17 +2942,22 @@ _bfd_ecoff_slurp_armap (bfd *abfd) parsed_size = mapdata->parsed_size; free (mapdata); - raw_armap = (char *) _bfd_alloc_and_read (abfd, parsed_size, parsed_size); - if (raw_armap == NULL) + if (parsed_size + 1 < 9) { - if (bfd_get_error () != bfd_error_system_call) - bfd_set_error (bfd_error_malformed_archive); + bfd_set_error (bfd_error_malformed_archive); return FALSE; } + raw_armap = (char *) _bfd_alloc_and_read (abfd, parsed_size + 1, parsed_size); + if (raw_armap == NULL) + return FALSE; + raw_armap[parsed_size] = 0; + ardata->tdata = (void *) raw_armap; count = H_GET_32 (abfd, raw_armap); + if ((parsed_size - 8) / 8 < count) + goto error_malformed; ardata->symdef_count = 0; ardata->cache = NULL; @@ -2960,6 +2965,7 @@ _bfd_ecoff_slurp_armap (bfd *abfd) /* This code used to overlay the symdefs over the raw archive data, but that doesn't work on a 64 bit host. */ stringbase = raw_armap + count * 8 + 8; + stringsize = parsed_size - (count * 8 + 8); #ifdef CHECK_ARMAP_HASH { @@ -3007,7 +3013,7 @@ _bfd_ecoff_slurp_armap (bfd *abfd) amt *= sizeof (carsym); symdef_ptr = (carsym *) bfd_alloc (abfd, amt); if (!symdef_ptr) - return FALSE; + goto error_exit; ardata->symdefs = symdef_ptr; @@ -3020,6 +3026,8 @@ _bfd_ecoff_slurp_armap (bfd *abfd) if (file_offset == 0) continue; name_offset = H_GET_32 (abfd, raw_ptr); + if (name_offset > stringsize) + goto error_malformed; symdef_ptr->name = stringbase + name_offset; symdef_ptr->file_offset = file_offset; ++symdef_ptr; @@ -3028,10 +3036,17 @@ _bfd_ecoff_slurp_armap (bfd *abfd) ardata->first_file_filepos = bfd_tell (abfd); /* Pad to an even boundary. */ ardata->first_file_filepos += ardata->first_file_filepos % 2; - abfd->has_armap = TRUE; - return TRUE; + + error_malformed: + bfd_set_error (bfd_error_malformed_archive); + error_exit: + ardata->symdef_count = 0; + ardata->symdefs = NULL; + ardata->tdata = NULL; + bfd_release (abfd, raw_armap); + return FALSE; } /* Write out an armap. */ -- Alan Modra Australia Development Lab, IBM