* Re: Bug 23686, two segment faults in nm
@ 2023-05-20 11:46 Alan Modra
0 siblings, 0 replies; 2+ messages in thread
From: Alan Modra @ 2023-05-20 11:46 UTC (permalink / raw)
To: binutils
The fix for pr23686 had a hole in the reloc address sanity check,
the calculation could overflow. Note that stabsize is known to be a
non-zero multiple of 12 so stabsize - 4 can't underflow.
PR 23686
* syms.c (_bfd_stab_section_find_nearest_line): Correct
r->address sanity check.
diff --git a/bfd/syms.c b/bfd/syms.c
index 6979096fbc6..d756995d767 100644
--- a/bfd/syms.c
+++ b/bfd/syms.c
@@ -1106,7 +1106,7 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
|| r->howto->pc_relative
|| r->howto->bitpos != 0
|| r->howto->dst_mask != 0xffffffff
- || octets + 4 > stabsize)
+ || octets > stabsize - 4)
{
_bfd_error_handler
(_("unsupported .stab relocation"));
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
* Bug 23686, two segment faults in nm
@ 2018-09-20 7:59 Alan Modra
0 siblings, 0 replies; 2+ messages in thread
From: Alan Modra @ 2018-09-20 7:59 UTC (permalink / raw)
To: binutils
Fixes the bugs exposed by the testcases in the PR, plus two more bugs
I noticed when looking at _bfd_stab_section_find_nearest_line.
PR 23686
* dwarf2.c (read_section): Error when attempting to malloc
"(bfd_size_type) -1".
* syms.c (_bfd_stab_section_find_nearest_line): Bounds check
function_name. Bounds check reloc address. Formatting. Ensure
.stabstr zero terminated.
diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
index 3b2885599e..77a7368dc0 100644
--- a/bfd/dwarf2.c
+++ b/bfd/dwarf2.c
@@ -527,6 +527,7 @@ read_section (bfd * abfd,
asection *msec;
const char *section_name = sec->uncompressed_name;
bfd_byte *contents = *section_buffer;
+ bfd_size_type amt;
/* The section may have already been read. */
if (contents == NULL)
@@ -549,7 +550,13 @@ read_section (bfd * abfd,
*section_size = msec->rawsize ? msec->rawsize : msec->size;
/* Paranoia - alloc one extra so that we can make sure a string
section is NUL terminated. */
- contents = (bfd_byte *) bfd_malloc (*section_size + 1);
+ amt = *section_size + 1;
+ if (amt == 0)
+ {
+ bfd_set_error (bfd_error_no_memory);
+ return FALSE;
+ }
+ contents = (bfd_byte *) bfd_malloc (amt);
if (contents == NULL)
return FALSE;
if (syms
diff --git a/bfd/syms.c b/bfd/syms.c
index 187071fada..e09640ab74 100644
--- a/bfd/syms.c
+++ b/bfd/syms.c
@@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
0, strsize))
return FALSE;
+ /* Stab strings ought to be nul terminated. Ensure the last one
+ is, to prevent running off the end of the buffer. */
+ info->strs[strsize - 1] = 0;
+
/* If this is a relocatable object file, we have to relocate
the entries in .stab. This should always be simple 32 bit
relocations against symbols defined in this object file, so
@@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
|| r->howto->bitsize != 32
|| r->howto->pc_relative
|| r->howto->bitpos != 0
- || r->howto->dst_mask != 0xffffffff)
+ || r->howto->dst_mask != 0xffffffff
+ || r->address * bfd_octets_per_byte (abfd) + 4 > stabsize)
{
_bfd_error_handler
(_("unsupported .stab relocation"));
@@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
{
nul_fun = stab;
nul_str = str;
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
+ if (file_name >= (char *) info->strs + strsize
+ || file_name < (char *) str)
file_name = NULL;
if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize
&& *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO)
@@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
directory_name = file_name;
file_name = ((char *) str
+ bfd_get_32 (abfd, stab + STRDXOFF));
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
+ if (file_name >= (char *) info->strs + strsize
+ || file_name < (char *) str)
file_name = NULL;
}
}
@@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
/* PR 17512: file: 0c680a1f. */
/* PR 17512: file: 5da8aec4. */
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
+ if (file_name >= (char *) info->strs + strsize
+ || file_name < (char *) str)
file_name = NULL;
break;
@@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
if (function_name == (char *) str)
continue;
- if (function_name >= (char *) info->strs + strsize)
+ if (function_name >= (char *) info->strs + strsize
+ || function_name < (char *) str)
function_name = NULL;
nul_fun = NULL;
@@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
if (val <= offset)
{
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
+ if (file_name >= (char *) info->strs + strsize
+ || file_name < (char *) str)
file_name = NULL;
*pline = 0;
}
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-05-20 11:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-20 11:46 Bug 23686, two segment faults in nm Alan Modra
-- strict thread matches above, loose matches on Subject: below --
2018-09-20 7:59 Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).