From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: asan: buffer overflow in peXXigen.c
Date: Wed, 16 Feb 2022 22:00:59 +1030 [thread overview]
Message-ID: <YgzgcwqgJZWXol6q@squeak.grove.modra.org> (raw)
* peXXigen.c (_bfd_XX_bfd_copy_private_bfd_data_common): Properly
sanity check DataDirectory[PE_DEBUG_DATA].Size.
diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index c71dacd4bf0..d11ea01c554 100644
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -2937,6 +2937,7 @@ bool
_bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
{
pe_data_type *ipe, *ope;
+ bfd_size_type size;
/* One day we may try to grok other private data. */
if (ibfd->xvec->flavour != bfd_target_coff_flavour
@@ -2971,7 +2972,8 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
memcpy (ope->dos_message, ipe->dos_message, sizeof (ope->dos_message));
/* The file offsets contained in the debug directory need rewriting. */
- if (ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size != 0)
+ size = ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size;
+ if (size != 0)
{
bfd_vma addr = ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].VirtualAddress
+ ope->pe_opthdr.ImageBase;
@@ -2980,12 +2982,16 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
representing s_size, not virt_size). Therefore don't look for the
section containing the first byte, but for that covering the last
one. */
- bfd_vma last = addr + ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size - 1;
+ bfd_vma last = addr + size - 1;
asection *section = find_section_by_vma (obfd, last);
bfd_byte *data;
+ bfd_vma dataoff = addr - section->vma;
/* PR 17512: file: 0f15796a. */
- if (section && addr < section->vma)
+ if (section
+ && (addr < section->vma
+ || section->size < dataoff
+ || section->size - dataoff < size))
{
/* xgettext:c-format */
_bfd_error_handler
@@ -3000,7 +3006,7 @@ _bfd_XX_bfd_copy_private_bfd_data_common (bfd * ibfd, bfd * obfd)
{
unsigned int i;
struct external_IMAGE_DEBUG_DIRECTORY *dd =
- (struct external_IMAGE_DEBUG_DIRECTORY *)(data + (addr - section->vma));
+ (struct external_IMAGE_DEBUG_DIRECTORY *)(data + dataoff);
for (i = 0; i < ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size
/ sizeof (struct external_IMAGE_DEBUG_DIRECTORY); i++)
--
Alan Modra
Australia Development Lab, IBM
next reply other threads:[~2022-02-16 11:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-16 11:30 Alan Modra [this message]
2022-03-17 10:58 Alan Modra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YgzgcwqgJZWXol6q@squeak.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).