[patch bfd]: Prevent possible buffer overflow on pdata-section sorting

[Kai Tietz <ktietz70@googlemail.com>]

[-- Attachment #1: Type: text/plain, Size: 455 bytes --]

Hello,

this issue was reported by H. Becker to me.  He found that the code in
peXXigen.c about pdata-section sorting might cause a buffer-overrun
for large pdata-data.  By working in private allocated buffer -
instead of using the pfinfo->contents - avoids this.

ChangeLog

2011-04-06  Kai Tietz

        * peXXigen.c (_bfd_XXi_final_link_postscripte): Sort pdata in temporary
        buffer.

Tested for x86_64-w64-mingw32. Ok for apply?

Regards,
Kai

[-- Attachment #2: pdata_x64_sort.txt --]
[-- Type: text/plain, Size: 1074 bytes --]

Index: src/bfd/peXXigen.c
===================================================================
--- src.orig/bfd/peXXigen.c	2010-12-21 19:33:07.000000000 +0100
+++ src/bfd/peXXigen.c	2011-04-06 18:19:45.945394800 +0200
@@ -2459,14 +2459,22 @@ _bfd_XXi_final_link_postscript (bfd * ab
     if (sec)
       {
 	bfd_size_type x = sec->rawsize ? sec->rawsize : sec->size;
+	bfd_byte *tmp_data = NULL;
 
-	if (x && bfd_get_section_contents (abfd, sec, pfinfo->contents, 0, x))
+	if (x)
+	  tmp_data = bfd_malloc (x);
+
+	if (tmp_data != NULL)
 	  {
-	    qsort (pfinfo->contents,
-	    	   (size_t) ((sec->size <x ? sec->size : x) / 12),
-	    	   12, sort_x64_pdata);
-	    bfd_set_section_contents (pfinfo->output_bfd, sec,
-	    			      pfinfo->contents, 0, x);
+	    if (bfd_get_section_contents (abfd, sec, tmp_data, 0, x))
+	      {
+		qsort (tmp_data,
+		       (size_t) ((sec->size <x ? sec->size : x) / 12),
+		       12, sort_x64_pdata);
+		bfd_set_section_contents (pfinfo->output_bfd, sec,
+					  tmp_data, 0, x);
+	      }
+	    free (tmp_data);
 	  }
       }
   }