From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by sourceware.org (Postfix) with ESMTPS id 434E43858004 for ; Wed, 24 Feb 2021 02:26:23 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 434E43858004 Received: by mail-pg1-x535.google.com with SMTP id p21so459446pgl.12 for ; Tue, 23 Feb 2021 18:26:23 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=8TfYoG5MWdcd1D9VS+VRLka0cYTgcHY1uLZQRiJ226s=; b=Ut/TAcddY3qP/x6ut8aI3GXIw5iQDnlCNuQZtVPo8Gd4R9toErFy+9bD5wkv0+FHxW BOagEMlNG3LePIg9Y9MCdZHADhTDrxuUJKGzn7F8en3e0nismufLklVNAY4IwXBoU5L3 AQ4Eqlq4TCu5eu7Nq01uNZYiaoteo8zvmrRIYKkycR094qb7mitS+Xz8tejnZ0uYj/dK DP8v23axhnJlIFl+ISlVUeUg7KRVa5Jniq7Jwc4oKWjn+uhZjFY9xortrT30FLpw2DT9 7Qem3J8hBIZ0T0Q4Fdmv/K3sv6SdNgzcK0uJVQzzWlTloq6ckH350X9uJIwCmP+6+IM4 qfoQ== X-Gm-Message-State: AOAM5336DOR0KWWfQdpG4Okf9o1yju56OahCwym/adaGwMiiAi3qVL6W c+xvXYUJ8uceBFaeyypNXWw9eylspX6AHA== X-Google-Smtp-Source: ABdhPJxx4u96TorNAgojpInOWoGcy/RyoVEB93lo3l1KIqAsC4QiWuDHMW0F75FsmcpCVLWpAcXP4w== X-Received: by 2002:a65:4947:: with SMTP id q7mr14334846pgs.83.1614133582088; Tue, 23 Feb 2021 18:26:22 -0800 (PST) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id z137sm438395pfc.172.2021.02.23.18.26.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Feb 2021 18:26:21 -0800 (PST) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 4571D41AB8; Wed, 24 Feb 2021 12:56:18 +1030 (ACDT) Date: Wed, 24 Feb 2021 12:56:18 +1030 From: Alan Modra To: binutils@sourceware.org Subject: PR27459, segmentation fault in go32exe_check_format Message-ID: <20210224022618.GN6042@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-3041.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Feb 2021 02:26:24 -0000 PR 27459 * coff-stgo32.c (go32exe_check_format): Sanity check size of header to avoid a buffer overflow. diff --git a/bfd/coff-stgo32.c b/bfd/coff-stgo32.c index 7ae9419772..7593b62e8e 100644 --- a/bfd/coff-stgo32.c +++ b/bfd/coff-stgo32.c @@ -304,7 +304,9 @@ go32exe_check_format (bfd *abfd) /* Confirm that this is a go32stub. */ header_end = H_GET_16 (abfd, filehdr_dos.e_cparhdr) * 16UL; - if (! CONST_STRNEQ (go32exe_temp_stub + header_end, "go32stub")) + if (go32exe_temp_stub_size < header_end + || go32exe_temp_stub_size - header_end < sizeof "go32stub" - 1 + || !CONST_STRNEQ (go32exe_temp_stub + header_end, "go32stub")) goto fail_format; /* Set origin to where the COFF header starts and seek there. */ -- Alan Modra Australia Development Lab, IBM