From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) by sourceware.org (Postfix) with ESMTPS id 56FF73858D33 for ; Fri, 17 Feb 2023 02:38:54 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 56FF73858D33 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pf1-x42d.google.com with SMTP id g9so2682684pfo.5 for ; Thu, 16 Feb 2023 18:38:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=ACtjIe/HrLr8QaS8oQlAEeB2Ftd65aRmqgVexyKuhXs=; b=dHG0pACZYMxOqeV3xBjD9bH7fMt3VA5B6RakolbWZHAJjwIlv4yZvWJBR0v2wwx2Si JxJl/1nDJjbfzpNss44QuxyCqlKTueBTHnxhFD77F6YZElycPgCztqXfY0hksFfzprvg ZjIP6A+O5u4QjkLxmvDjZ4v7ooQp/8W5o/29WLjk2Xs/jSDWyYybuz+a3CAq2XOQ2oTs QHsECjpXBVxhw7De4uuWawneDs51Ad5W+T/GEZ62CMP/5Y4hIR1Qo7ETzILCrocdAeW/ 4Q6RCkLZc+3eQO054pKmbUaDTW4kajSNDbpuBzX8hVhJBo9gjQrDLqVCK44aSFdf2l+l 4XqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ACtjIe/HrLr8QaS8oQlAEeB2Ftd65aRmqgVexyKuhXs=; b=HPR2Hs9I/ajpxl25brJYLYmV5RBB/ci8LFwRHfDK9AsXGYkeFK2y01OLt/YfePdLa2 OD7JJRirSYmaZDhaw5cE92Y5dQhMXakidXK55JIfffXSiOYJ+eSrjOvmD6fGIAgnqG2y Y1K3IqUEHo28h4BU8d+7BIBRLGeJi+BSbTbkfE+1dTcFiFHdLtqjfTVGpvFBKBORr7Gq Wd9/jb1dns9FM7wYzs74gX/2n5An5+dtYovxOH5/9Xczd0GTD1hx79tQO9D+AuWNuGwJ rx8Ztbqa2Zkzyg9w9VXIBNZjXxO2Pu5S1o+/wt4ZEkgQ8Za4bRWGlALYnTrT55NoiOR5 2YnA== X-Gm-Message-State: AO0yUKXg7ScyLLjEz1EbnoVsCsOLnAw0zYqvB3dKwvpTmQHuEKLaIgwd BpVlyJOVCKJTu7RVXbQ6LVeIhLu1ppg= X-Google-Smtp-Source: AK7set/AgXj9YPrrlKqFU832wek1S0BM4OY73x45nXU+UIIQ8hMv1yNOZuU5Dc1ULMG3VNFnP+2Gng== X-Received: by 2002:a05:6a00:cd:b0:5a9:bd0c:4704 with SMTP id e13-20020a056a0000cd00b005a9bd0c4704mr2382194pfj.14.1676601533199; Thu, 16 Feb 2023 18:38:53 -0800 (PST) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id l11-20020a62be0b000000b0058b927b9653sm1985808pff.92.2023.02.16.18.38.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Feb 2023 18:38:52 -0800 (PST) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 4713F11418D0; Fri, 17 Feb 2023 13:08:50 +1030 (ACDT) Date: Fri, 17 Feb 2023 13:08:50 +1030 From: Alan Modra To: binutils@sourceware.org Subject: Wild pointer reads in _bfd_ecoff_locate_line Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3035.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: * ecofflink.c (mk_fdrtab): Sanity check fdr procedure descriptor pointer and isymBase. Set fdrtab_len after possible discards. Use size_t vars and catch possible size overflows. diff --git a/bfd/ecofflink.c b/bfd/ecofflink.c index 3521dc8c4d6..e902bd51d53 100644 --- a/bfd/ecofflink.c +++ b/bfd/ecofflink.c @@ -1730,8 +1730,8 @@ mk_fdrtab (bfd *abfd, FDR *fdr_start; FDR *fdr_end; bool stabs; - long len; - bfd_size_type amt; + size_t len; + size_t amt; fdr_start = debug_info->fdr; fdr_end = fdr_start + debug_info->symbolic_header.ifdMax; @@ -1739,17 +1739,26 @@ mk_fdrtab (bfd *abfd, /* First, let's see how long the table needs to be. */ for (len = 0, fdr_ptr = fdr_start; fdr_ptr < fdr_end; fdr_ptr++) { - if (fdr_ptr->cpd == 0) /* Skip FDRs that have no PDRs. */ + /* Sanity check fdr procedure descriptor pointer. */ + long ipdMax = debug_info->symbolic_header.ipdMax; + if (fdr_ptr->ipdFirst >= ipdMax + || fdr_ptr->cpd > ipdMax - fdr_ptr->ipdFirst) + fdr_ptr->cpd = 0; + /* Skip FDRs that have no PDRs. */ + if (fdr_ptr->cpd == 0) continue; ++len; } /* Now, create and fill in the table. */ - amt = (bfd_size_type) len * sizeof (struct ecoff_fdrtab_entry); + if (_bfd_mul_overflow (len, sizeof (struct ecoff_fdrtab_entry), &amt)) + { + bfd_set_error (bfd_error_file_too_big); + return false; + } line_info->fdrtab = (struct ecoff_fdrtab_entry*) bfd_zalloc (abfd, amt); if (line_info->fdrtab == NULL) return false; - line_info->fdrtab_len = len; tab = line_info->fdrtab; for (fdr_ptr = fdr_start; fdr_ptr < fdr_end; fdr_ptr++) @@ -1766,6 +1775,10 @@ mk_fdrtab (bfd *abfd, char *sym_ptr; SYMR sym; + if ((long) ((unsigned long) fdr_ptr->isymBase + 1) <= 0 + || fdr_ptr->isymBase + 1 >= debug_info->symbolic_header.isymMax) + continue; + sym_ptr = ((char *) debug_info->external_sym + (fdr_ptr->isymBase + 1) * debug_swap->external_sym_size); (*debug_swap->swap_sym_in) (abfd, sym_ptr, &sym); @@ -1797,12 +1810,14 @@ mk_fdrtab (bfd *abfd, tab->fdr = fdr_ptr; ++tab; } + len = tab - line_info->fdrtab; + line_info->fdrtab_len = len; /* Finally, the table is sorted in increasing memory-address order. The table is mostly sorted already, but there are cases (e.g., static functions in include files), where this does not hold. Use "odump -PFv" to verify... */ - qsort (line_info->fdrtab, (size_t) len, + qsort (line_info->fdrtab, len, sizeof (struct ecoff_fdrtab_entry), cmp_fdrtab_entry); return true; -- Alan Modra Australia Development Lab, IBM