From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) by sourceware.org (Postfix) with ESMTPS id 85149385E008 for ; Wed, 25 Mar 2020 12:02:18 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 85149385E008 Received: by mail-pf1-x42c.google.com with SMTP id 23so960718pfj.1 for ; Wed, 25 Mar 2020 05:02:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=FwKJ//OsqrZfAoul6+8G2DRN8xA4gjXMY5+SQjsajEU=; b=Pavktmi6UMudAAu/ZIUbzxPv1bGmFWO32nCLA9du3T+qQ/ekG/2ZNGr6UYEGoHw1bH CsxOGusAY4Nlg2r+mTOiYKB27nlEMALuImp4Qc5+9HQJSc2crLuQFWTAwTqfWh+8ZGn7 mYXxfNr10hrN4xvTxmWoGJweNSPwSa3v3ogMeB5tPj+xUfTeHdqB1WJKUzr5UnxggP7i QiBXkF7MBzuD1bl03Cs1AzWvA0+QLaY/g8VxIuNisdO0eyRNQ+VWdlIzwHDuV0yrahLA BsHGPl6CuPNQLSV/m9dLuZ3E3ot8/GTgYZ0hUB6ftr7R+RCTjSQVTMMy9O7KjQyFUXV2 eYUA== X-Gm-Message-State: ANhLgQ0FTVtSXRQUXINIfycw6qHEEj+PylmqytR4XAYIVqTyWS1WHqej gjnbH6Z+0giAxmWpJA5a8GLw/byqbFc= X-Google-Smtp-Source: ADFU+vsbnO3y48iWzWIy1fE6oQ4coWAzqZUVNMuEtJRbq6eoVmSZqivT/uNYUVW8vWUSek5q3JjjPw== X-Received: by 2002:a65:53c5:: with SMTP id z5mr3015284pgr.0.1585137736961; Wed, 25 Mar 2020 05:02:16 -0700 (PDT) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id h4sm18450679pfg.177.2020.03.25.05.02.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Mar 2020 05:02:16 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id D238A80D35; Wed, 25 Mar 2020 22:32:12 +1030 (ACDT) Date: Wed, 25 Mar 2020 22:32:12 +1030 From: Alan Modra To: binutils@sourceware.org Subject: readelf looping in process_archive Message-ID: <20200325120212.GG4583@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-26.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2020 12:02:19 -0000 With a crafted "negative" ar_hdr.ar_size it is possible to make readelf loop. This patch catches the overflow in a file offset calculation. * readelf.c (process_archive): Prevent endless loop. diff --git a/binutils/readelf.c b/binutils/readelf.c index 1f0f49222f..9bc15e4d0b 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -20505,11 +20505,13 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) { free (name); archive_file_offset = arch.next_arhdr_offset; - arch.next_arhdr_offset += archive_file_size; - filedata->file_name = qualified_name; if (! process_object (filedata)) ret = FALSE; + arch.next_arhdr_offset += archive_file_size; + /* Stop looping with "negative" archive_file_size. */ + if (arch.next_arhdr_offset < archive_file_size) + break; } free (qualified_name); -- Alan Modra Australia Development Lab, IBM