From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) by sourceware.org (Postfix) with ESMTPS id 2D9D5395200F for ; Thu, 17 Mar 2022 11:01:00 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 2D9D5395200F Received: by mail-io1-xd34.google.com with SMTP id d62so5380670iog.13 for ; Thu, 17 Mar 2022 04:01:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition; bh=uDZkAU705xglVuzPr1RKDb51LBje6GXnTGl5i0VZCMM=; b=FlMIXiCql0WhFI/UexRam+aY5EIlEP2g38c6Ez7qyCp7AM2CcjOSzgH8mFm/hHyibe IGH0VrfL20ezc7q/WAsZvqg4hxyEWRqgHfM6ZgVwIGBnUDR0I0os7ZGHi7ful43y7BjX p9CgqR8VBnLmkNlcG1xPAeV+HQFzDDb5EoxVs93kYNoeqdNrTuyGxltluvvHz+d8AKWL ZgNTR9hCGgm+3n5Xb2JVWz5O7ZDmqbxQn5HAkn25cnNMR30mZ8KdNf7yWr48xZwYusWU c8RnkTzsDr7PqdgIcZhFG55mQu6yh30ZD3jPyavAQuD+ka3DygCO18fdFiOZXYKQsahy EfZw== X-Gm-Message-State: AOAM532Co4QXXj1zdzxU2QDykto0Xh2VTAefDQPy/+YRnpBKD+xTfAnF 2Ekc1y29IODzLsmemj23IVe+om905No= X-Google-Smtp-Source: ABdhPJxPWhOGyJUcxyXnnDFIVNTynZnJEhjAXAW3VYperBIqz0QfZiyn2axzSDvVIORJKfQJZsnV2g== X-Received: by 2002:a5d:8898:0:b0:645:e689:3381 with SMTP id d24-20020a5d8898000000b00645e6893381mr1894816ioo.179.1647514859007; Thu, 17 Mar 2022 04:00:59 -0700 (PDT) Received: from squeak.grove.modra.org ([2406:3400:51d:8cc0:2bc3:de1a:326f:fd59]) by smtp.gmail.com with ESMTPSA id x14-20020a056e021bce00b002c7ada1bec5sm2608239ilv.88.2022.03.17.04.00.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Mar 2022 04:00:58 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id C09981140025; Thu, 17 Mar 2022 21:30:55 +1030 (ACDT) Date: Thu, 17 Mar 2022 21:30:55 +1030 From: Alan Modra To: binutils@sourceware.org Subject: asan: Buffer overflow in som_set_reloc_info Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3036.9 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2022 11:01:01 -0000 * som.c (som_set_reloc_info): Add symcount parameter. Don't access symbols past symcount. Don't access fixup past end_fixups. (som_slurp_reloc_table): Adjust som_set_reloc_info calls. diff --git a/bfd/som.c b/bfd/som.c index d53a3b90b02..3c0b68a444e 100644 --- a/bfd/som.c +++ b/bfd/som.c @@ -4939,6 +4939,7 @@ som_set_reloc_info (unsigned char *fixup, arelent *internal_relocs, asection *section, asymbol **symbols, + unsigned int symcount, bool just_count) { unsigned int op, varname, deallocate_contents = 0; @@ -5032,7 +5033,7 @@ som_set_reloc_info (unsigned char *fixup, else if (ISLOWER (c)) { int bits = (c - 'a') * 8; - for (v = 0; c > 'a'; --c) + for (v = 0; c > 'a' && fixup < end_fixups; --c) v = (v << 8) | *fixup++; if (varname == 'V') v = sign_extend (v, bits); @@ -5093,7 +5094,7 @@ som_set_reloc_info (unsigned char *fixup, /* A symbol to use in the relocation. Make a note of this if we are not just counting. */ case 'S': - if (! just_count) + if (! just_count && (unsigned int) c < symcount) rptr->sym_ptr_ptr = &symbols[c]; break; /* Argument relocation bits for a function call. */ @@ -5309,7 +5310,7 @@ som_slurp_reloc_table (bfd *abfd, need it again. */ section->reloc_count = som_set_reloc_info (external_relocs, fixup_stream_size, - NULL, NULL, NULL, true); + NULL, NULL, NULL, 0, true); som_section_data (section)->reloc_stream = external_relocs; } @@ -5335,7 +5336,8 @@ som_slurp_reloc_table (bfd *abfd, /* Process and internalize the relocations. */ som_set_reloc_info (external_relocs, fixup_stream_size, - internal_relocs, section, symbols, false); + internal_relocs, section, symbols, + bfd_get_symcount (abfd), false); /* We're done with the external relocations. Free them. */ free (external_relocs); -- Alan Modra Australia Development Lab, IBM