From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: _bfd_ecoff_slurp_symbol_table buffer overflow
Date: Mon, 13 Feb 2023 23:08:30 +1030 [thread overview]
Message-ID: <Y+ovRotGLLHQE09t@squeak.grove.modra.org> (raw)
Add missing bounds check for local symbols, and tidy the existing
bounds checking.
* ecoff.c (_bfd_ecoff_slurp_symbol_table): Break overlong lines.
Set bfd_error. Bounds check internal_sym.iss.
diff --git a/bfd/ecoff.c b/bfd/ecoff.c
index 48f33df630e..7498766dd3f 100644
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -896,9 +896,13 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd)
(*swap_ext_in) (abfd, (void *) eraw_src, &internal_esym);
/* PR 17512: file: 3372-1000-0.004. */
- if (internal_esym.asym.iss >= ecoff_data (abfd)->debug_info.symbolic_header.issExtMax
+ HDRR *symhdr = &ecoff_data (abfd)->debug_info.symbolic_header;
+ if (internal_esym.asym.iss >= symhdr->issExtMax
|| internal_esym.asym.iss < 0)
- return false;
+ {
+ bfd_set_error (bfd_error_bad_value);
+ return false;
+ }
internal_ptr->symbol.name = (ecoff_data (abfd)->debug_info.ssext
+ internal_esym.asym.iss);
@@ -909,17 +913,13 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd)
return false;
/* The alpha uses a negative ifd field for section symbols. */
- if (internal_esym.ifd >= 0)
- {
- /* PR 17512: file: 3372-1983-0.004. */
- if (internal_esym.ifd >= ecoff_data (abfd)->debug_info.symbolic_header.ifdMax)
- internal_ptr->fdr = NULL;
- else
- internal_ptr->fdr = (ecoff_data (abfd)->debug_info.fdr
- + internal_esym.ifd);
- }
- else
+ /* PR 17512: file: 3372-1983-0.004. */
+ if (internal_esym.ifd >= symhdr->ifdMax
+ || internal_esym.ifd < 0)
internal_ptr->fdr = NULL;
+ else
+ internal_ptr->fdr = (ecoff_data (abfd)->debug_info.fdr
+ + internal_esym.ifd);
internal_ptr->local = false;
internal_ptr->native = (void *) eraw_src;
}
@@ -943,6 +943,14 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd)
SYMR internal_sym;
(*swap_sym_in) (abfd, (void *) lraw_src, &internal_sym);
+
+ HDRR *symhdr = &ecoff_data (abfd)->debug_info.symbolic_header;
+ if (internal_sym.iss >= symhdr->issMax
+ || internal_sym.iss < 0)
+ {
+ bfd_set_error (bfd_error_bad_value);
+ return false;
+ }
internal_ptr->symbol.name = (ecoff_data (abfd)->debug_info.ss
+ fdr_ptr->issBase
+ internal_sym.iss);
--
Alan Modra
Australia Development Lab, IBM
reply other threads:[~2023-02-13 12:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y+ovRotGLLHQE09t@squeak.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).