From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by sourceware.org (Postfix) with ESMTPS id E494C3857807 for ; Fri, 25 Sep 2020 02:24:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org E494C3857807 Received: by mail-pj1-x102c.google.com with SMTP id t7so1084984pjd.3 for ; Thu, 24 Sep 2020 19:24:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=PMeCxsEI7CgxK+aaelYYO3fJsIAqr0aaYEHwll528Ik=; b=uU9DyHRsu7w3Mx48aNuoipyByPTAwicbzz6ogcDoSzcT6TdwgVRDnkb/2ubqNbmEAc wsMgDW9Pin47XrmtoaRw684DSniT33VfKKGsSvfdZHpMfmOXyjfzAnOVDbbzReIvlHiT 6Qcn+54qSjq5hB+u8trnYaC3bX3d5/1w7MBf2vZR6NuH0aIlZY6aeCq7fimwwCNv1HR9 B5tVenGYMDZ/UzMJXZWV8LW8H1bsKdTeqa17QISvV1DSRCJlHWYZQ3J+X8BqVlNPh5oP iqk68p3xubFxiurJ9dZVcPM8+1P2vnb/LJvMSPqKcbSVhgb6s/8X+V2H9Ph/mcTldSva E+Ww== X-Gm-Message-State: AOAM533i1We5v+UYcgX/pHD0QC9aSYjEzD+RJrboJpokGYfi0XoG/dQ7 QaUI0FdvNjO1+bh9nb02jhfN4uLBVQoCVg== X-Google-Smtp-Source: ABdhPJzCjIiFcNxI49JUPMvZfRcJHb1Ew6Liixe9ASCfng665f45O1+R1MOvjDIrIvzQz1+KXNhT2g== X-Received: by 2002:a17:90a:b88c:: with SMTP id o12mr534145pjr.43.1601000656629; Thu, 24 Sep 2020 19:24:16 -0700 (PDT) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id i62sm731715pfe.140.2020.09.24.19.24.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2020 19:24:16 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 37FFC82E6A; Fri, 25 Sep 2020 11:54:12 +0930 (ACST) Date: Fri, 25 Sep 2020 11:54:12 +0930 From: Alan Modra To: binutils@sourceware.org Subject: asan: readelf buffer overflow and abort Message-ID: <20200925022411.GN5452@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-12.4 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 02:24:19 -0000 * elfcomm.c (byte_put_little_endian, byte_put_big_endian): Support more field sizes. * readelf.c (target_specific_reloc_handling ): Limit allowed reloc_size. Don't read_leb128 outside of section. diff --git a/binutils/elfcomm.c b/binutils/elfcomm.c index 37f9dbe7ee..81742bf75b 100644 --- a/binutils/elfcomm.c +++ b/binutils/elfcomm.c @@ -67,66 +67,31 @@ void (*byte_put) (unsigned char *, elf_vma, int); void byte_put_little_endian (unsigned char * field, elf_vma value, int size) { - switch (size) + if (size <= 0 || size > 8) { - case 8: - field[7] = (((value >> 24) >> 24) >> 8) & 0xff; - field[6] = ((value >> 24) >> 24) & 0xff; - field[5] = ((value >> 24) >> 16) & 0xff; - field[4] = ((value >> 24) >> 8) & 0xff; - /* Fall through. */ - case 4: - field[3] = (value >> 24) & 0xff; - /* Fall through. */ - case 3: - field[2] = (value >> 16) & 0xff; - /* Fall through. */ - case 2: - field[1] = (value >> 8) & 0xff; - /* Fall through. */ - case 1: - field[0] = value & 0xff; - break; - - default: error (_("Unhandled data length: %d\n"), size); abort (); } + while (size--) + { + *field++ = value & 0xff; + value >>= 8; + } } void byte_put_big_endian (unsigned char * field, elf_vma value, int size) { - switch (size) + if (size <= 0 || size > 8) { - case 8: - field[7] = value & 0xff; - field[6] = (value >> 8) & 0xff; - field[5] = (value >> 16) & 0xff; - field[4] = (value >> 24) & 0xff; - value >>= 16; - value >>= 16; - /* Fall through. */ - case 4: - field[3] = value & 0xff; - value >>= 8; - /* Fall through. */ - case 3: - field[2] = value & 0xff; - value >>= 8; - /* Fall through. */ - case 2: - field[1] = value & 0xff; - value >>= 8; - /* Fall through. */ - case 1: - field[0] = value & 0xff; - break; - - default: error (_("Unhandled data length: %d\n"), size); abort (); } + while (size--) + { + field[size] = value & 0xff; + value >>= 8; + } } elf_vma (*byte_get) (const unsigned char *, int); diff --git a/binutils/readelf.c b/binutils/readelf.c index 95720ea055..9ba4e29a65 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -12622,7 +12622,7 @@ target_specific_reloc_handling (Filedata * filedata, if (saved_sym != NULL) { bfd_vma value; - unsigned int reloc_size; + unsigned int reloc_size = 0; int leb_ret = 0; switch (reloc_type) { @@ -12631,15 +12631,16 @@ target_specific_reloc_handling (Filedata * filedata, break; case 11: /* R_MSP430_GNU_SET_ULEB128 */ case 22: /* R_MSP430X_GNU_SET_ULEB128 */ - read_leb128 (start + reloc->r_offset, end, FALSE, - &reloc_size, &leb_ret); + if (reloc->r_offset < (size_t) (end - start)) + read_leb128 (start + reloc->r_offset, end, FALSE, + &reloc_size, &leb_ret); break; default: reloc_size = 2; break; } - if (leb_ret != 0) + if (leb_ret != 0 || reloc_size == 0 || reloc_size > 8) error (_("MSP430 ULEB128 field at 0x%lx contains invalid " "ULEB128 value\n"), (long) reloc->r_offset); -- Alan Modra Australia Development Lab, IBM