* i386msdos uninitialised read
@ 2020-03-23 12:58 Alan Modra
2020-03-26 9:34 ` Alan Modra
0 siblings, 1 reply; 2+ messages in thread
From: Alan Modra @ 2020-03-23 12:58 UTC (permalink / raw)
To: binutils
Also reinstate ld i386aout for i386-msdos target, which doesn't build
otherwise. Maybe the target should disappear?
bfd/
* i386msdos.c (msdos_object_p): Don't access e_lfanew when that
field hasn't been read. Remove unnecessary casts.
ld/
* Makefile.am (ALL_EMULATION_SOURCES): Reinstate ei386aout.c.
Include ei386aout dep file.
* Makefile.in: Regenerate.
* po/BLD-POTFILES.in: Regenerate.
diff --git a/bfd/i386msdos.c b/bfd/i386msdos.c
index 5b56751cd3..e9307a7a42 100644
--- a/bfd/i386msdos.c
+++ b/bfd/i386msdos.c
@@ -47,10 +47,10 @@ msdos_object_p (bfd *abfd)
struct external_DOS_hdr hdr;
bfd_byte buffer[2];
asection *section;
- unsigned int size;
+ bfd_size_type size;
if (bfd_seek (abfd, (file_ptr) 0, SEEK_SET) != 0
- || bfd_bread (&hdr, (bfd_size_type) sizeof (hdr), abfd) < DOS_HDR_SIZE)
+ || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) < DOS_HDR_SIZE)
{
if (bfd_get_error () != bfd_error_system_call)
bfd_set_error (bfd_error_wrong_format);
@@ -67,9 +67,11 @@ msdos_object_p (bfd *abfd)
e_lfanew field will be valid and point to a header beginning with one of
the relevant signatures. If not, e_lfanew might point to anything, so
don't bail if we can't read there. */
- if (H_GET_16 (abfd, hdr.e_cparhdr) < 4
- || bfd_seek (abfd, (file_ptr) H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
- || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
+ if (size < offsetof (struct external_DOS_hdr, e_lfanew) + 4
+ || H_GET_16 (abfd, hdr.e_cparhdr) < 4)
+ ;
+ else if (bfd_seek (abfd, H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
+ || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
{
if (bfd_get_error () == bfd_error_system_call)
return NULL;
@@ -102,7 +104,7 @@ msdos_object_p (bfd *abfd)
size += H_GET_16 (abfd, hdr.e_cblp);
/* Check that the size is valid. */
- if (bfd_seek (abfd, (file_ptr) (section->filepos + size), SEEK_SET) != 0)
+ if (bfd_seek (abfd, section->filepos + size, SEEK_SET) != 0)
{
if (bfd_get_error () != bfd_error_system_call)
bfd_set_error (bfd_error_wrong_format);
diff --git a/ld/Makefile.am b/ld/Makefile.am
index 4a9b8404b7..a64899fc09 100644
--- a/ld/Makefile.am
+++ b/ld/Makefile.am
@@ -312,6 +312,7 @@ ALL_EMULATION_SOURCES = \
ehppalinux.c \
ehppanbsd.c \
ehppaobsd.c \
+ ei386aout.c \
ei386beos.c \
ei386bsd.c \
ei386go32.c \
@@ -800,6 +801,7 @@ $(ALL_EMULATION_SOURCES) $(ALL_64_EMULATION_SOURCES): $(GEN_DEPENDS)
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppalinux.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppanbsd.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppaobsd.Pc@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386aout.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386beos.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386bsd.Pc@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386go32.Pc@am__quote@
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: i386msdos uninitialised read
2020-03-23 12:58 i386msdos uninitialised read Alan Modra
@ 2020-03-26 9:34 ` Alan Modra
0 siblings, 0 replies; 2+ messages in thread
From: Alan Modra @ 2020-03-26 9:34 UTC (permalink / raw)
To: binutils
Another fix.
* i386msdos.c (msdos_object_p): Catch -1 return from bfd_bread.
diff --git a/bfd/i386msdos.c b/bfd/i386msdos.c
index e9307a7a42..38bb441034 100644
--- a/bfd/i386msdos.c
+++ b/bfd/i386msdos.c
@@ -50,7 +50,7 @@ msdos_object_p (bfd *abfd)
bfd_size_type size;
if (bfd_seek (abfd, (file_ptr) 0, SEEK_SET) != 0
- || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) < DOS_HDR_SIZE)
+ || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) + 1 < DOS_HDR_SIZE + 1)
{
if (bfd_get_error () != bfd_error_system_call)
bfd_set_error (bfd_error_wrong_format);
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-26 9:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-23 12:58 i386msdos uninitialised read Alan Modra
2020-03-26 9:34 ` Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).