From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: bfd_close_all_done bug and bfd_last_cache
Date: Mon, 21 Aug 2023 20:12:55 +0930 [thread overview]
Message-ID: <ZOM/r+CVUyFVrQZO@squeak.grove.modra.org> (raw)
bfd_close ought to always call iovec->bclose so that cache_bclose is
called. If not, bfd_last_cache will be left pointing at freed memory.
This bug was found by oss-fuzz with the trigger being an old bug in
the ia64-vms support. Given a file of the "wrong" size,
elf64_vms_close_and_cleanup attempted to extend it, leading to an
error since the file was opened read-only by nm. nm bad_file bad_file
then hit the use-after-free when opening the second file.
commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and
bfd_close_all_done, but didn't go quite far enough.
* elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't
attempt to extend read-only files.
* opncls.c (bfd_close_all_done): Always call _close_and_cleanup.
An old bug in the ia64-vms support can be used to tickle another bug
in bfd_close_all_done. If _close_and_cleanup returns an error,
diff --git a/bfd/elf64-ia64-vms.c b/bfd/elf64-ia64-vms.c
index f8e9922fc4a..ab1f18b8d81 100644
--- a/bfd/elf64-ia64-vms.c
+++ b/bfd/elf64-ia64-vms.c
@@ -4713,7 +4713,8 @@ static bool
elf64_vms_close_and_cleanup (bfd *abfd)
{
bool ret = true;
- if (bfd_get_format (abfd) == bfd_object)
+ if (bfd_get_format (abfd) == bfd_object
+ && bfd_write_p (abfd))
{
long isize;
diff --git a/bfd/opncls.c b/bfd/opncls.c
index 56a90046b1a..741d20e81da 100644
--- a/bfd/opncls.c
+++ b/bfd/opncls.c
@@ -920,13 +920,11 @@ bfd_close_all_done (bfd *abfd)
{
bool ret = BFD_SEND (abfd, _close_and_cleanup, (abfd));
- if (ret && abfd->iovec != NULL)
- {
- ret = abfd->iovec->bclose (abfd) == 0;
+ if (abfd->iovec != NULL)
+ ret &= abfd->iovec->bclose (abfd) == 0;
- if (ret)
- _maybe_make_executable (abfd);
- }
+ if (ret)
+ _maybe_make_executable (abfd);
_bfd_delete_bfd (abfd);
free (_bfd_error_buf);
--
Alan Modra
Australia Development Lab, IBM
reply other threads:[~2023-08-21 10:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZOM/r+CVUyFVrQZO@squeak.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).