From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-x636.google.com (mail-pl1-x636.google.com [IPv6:2607:f8b0:4864:20::636]) by sourceware.org (Postfix) with ESMTPS id A2C213850208 for ; Wed, 14 Sep 2022 07:48:26 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org A2C213850208 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pl1-x636.google.com with SMTP id x1so14309866plv.5 for ; Wed, 14 Sep 2022 00:48:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date; bh=AIJw75HZT2QYmZhJLM3Yuk3VWWU4zhC3GhzC0vAeMOc=; b=KRnRyi6ufNkUtXNoRMiEDXpqb8hUdonABv+XcFU+qvMXlqll88e92tR0scUyqSSGC5 hI7arQ7gjAxyCZHpd0DOWWGMKOhK7WIEd62xtUWGznz79ozV+v89AC+JNxQc50c4InKP uk2LMPyQxNexMPV5n/k8m8Hws5lJvphQQnQWauO3HcZ9LlW8htuJ6qXACLPSpIqxwKwK P1Zyd276vsFsoJKjzaBNLHFWhSgHlei48tI7+hGjxZmPASXLg989jmfqo9D3RvQrDLYF IZ0IF7Di/JYmPmd5s/ekntAesUBY1i53ZBlpfEDvjpcbE4DG+td7nY4tWU9Xm+lXyK2S LrkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date; bh=AIJw75HZT2QYmZhJLM3Yuk3VWWU4zhC3GhzC0vAeMOc=; b=YUPJ+ikl8DVJqkdUQoSOpOQnHR2QDek8IGqETL3HpY8AK8aROVimQXIzrdxDUCHwti kCoV1HpOh6TvxTUtreHI2ui9XbYKPlUdP04LXXcaK7gueHMIJGjQkkDOwN/ktftbYqOI dD62hxhhGK9GDNnrzWXGJdq5YPQHAMD0jFPvvQD5xVfOlguHJaAh4BVEYWokQBJfIVlA ONx3BLuQSt8rKtGgEeTayG6licukHnMI4nOracUMoH8QpIRM6g2bU3NAX6KNRtLu+9I7 reUGIxnXQUrsT/YvpblYENTtoAxLABNZo/KiboAmlOLJKZiHO9ErjOEOe6mKpIcxh6wx 2Rtg== X-Gm-Message-State: ACgBeo3hiWC0zE7gTcLfGbBN8DddgKY9hURi6QbNT+4xQJlkHMEntW7D oU6m624FgjJQV4SyvFkS+SpTV759eTA= X-Google-Smtp-Source: AA6agR5fgVjU0XIwsRVAl3//UD0IzJeEWvBxTAmqAiNaFFYiK2OWcmrVL1GPEoa+ZPlwW0N7otKjCQ== X-Received: by 2002:a17:902:c944:b0:178:4568:9f99 with SMTP id i4-20020a170902c94400b0017845689f99mr7546930pla.98.1663141705433; Wed, 14 Sep 2022 00:48:25 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id w37-20020a631625000000b0041bfa382dfesm8919354pgl.67.2022.09.14.00.48.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Sep 2022 00:48:24 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 0581D1140320; Wed, 14 Sep 2022 17:18:21 +0930 (ACST) Date: Wed, 14 Sep 2022 17:18:21 +0930 From: Alan Modra To: binutils@sourceware.org Subject: looping in bfd_mach_o_fat_openr_next_archived_file Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3036.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: mach-o.c doesn't sanity check mach-o-fat archives, making it easy for fuzzers to create an archive with mach_o_fat_archentry headers that point to the same offset. bfd_mach_o_fat_openr_next_archived_file uses the previous element offset to find its header, and thus the next element. If two offsets are the same, any tool reading the archive will get stuck. This patch rejects such archives, and any with overlapping elements. * mach-o.c (overlap_previous): New function. (bfd_mach_o_fat_archive_p): Sanity check that elements do not overlap each other or the file and archive headers. diff --git a/bfd/mach-o.c b/bfd/mach-o.c index eb325236454..acb35e7f0c6 100644 --- a/bfd/mach-o.c +++ b/bfd/mach-o.c @@ -5497,6 +5497,22 @@ typedef struct mach_o_fat_data_struct mach_o_fat_archentry *archentries; } mach_o_fat_data_struct; +/* Check for overlapping archive elements. Note that we can't allow + multiple elements at the same offset even if one is empty, because + bfd_mach_o_fat_openr_next_archived_file assume distinct offsets. */ +static bool +overlap_previous (const mach_o_fat_archentry *elt, unsigned long i) +{ + unsigned long j = i; + while (j-- != 0) + if (elt[i].offset == elt[j].offset + || (elt[i].offset > elt[j].offset + ? elt[i].offset - elt[j].offset < elt[j].size + : elt[j].offset - elt[i].offset < elt[i].size)) + return true; + return false; +} + bfd_cleanup bfd_mach_o_fat_archive_p (bfd *abfd) { @@ -5545,10 +5561,13 @@ bfd_mach_o_fat_archive_p (bfd *abfd) adata->archentries[i].offset = bfd_getb32 (arch.offset); adata->archentries[i].size = bfd_getb32 (arch.size); adata->archentries[i].align = bfd_getb32 (arch.align); - if (filesize != 0 - && (adata->archentries[i].offset > filesize - || (adata->archentries[i].size - > filesize - adata->archentries[i].offset))) + if ((filesize != 0 + && (adata->archentries[i].offset > filesize + || (adata->archentries[i].size + > filesize - adata->archentries[i].offset))) + || (adata->archentries[i].offset + < sizeof (hdr) + adata->nfat_arch * sizeof (arch)) + || overlap_previous (adata->archentries, i)) { bfd_release (abfd, adata); bfd_set_error (bfd_error_malformed_archive); -- Alan Modra Australia Development Lab, IBM