* Missing check for NULL
@ 2023-09-12 15:24 jacob navia
2023-09-13 6:39 ` Alan Modra
0 siblings, 1 reply; 2+ messages in thread
From: jacob navia @ 2023-09-12 15:24 UTC (permalink / raw)
To: binutils
[-- Attachment #1: Type: text/plain, Size: 1292 bytes --]
Hi
A missing check for NULL.
FILE: elf.c line 3091
Function: _bfd_elf_init_reloc_shdr
static bool
_bfd_elf_init_reloc_shdr (bfd *abfd,
struct bfd_elf_section_reloc_data *reldata,
const char *sec_name,
bool use_rela_p,
bool delay_st_name_p)
{
Elf_Internal_Shdr *rel_hdr;
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
BFD_ASSERT (reldata->hdr == NULL);<<<<<<<<<<<<<<< Next line BUG!
rel_hdr = bfd_zalloc (abfd, sizeof (*rel_hdr)); // bfd_zalloc can return NULL
reldata->hdr = rel_hdr;
if (delay_st_name_p)
rel_hdr->sh_name = (unsigned int) -1;
else if (!_bfd_elf_set_reloc_sh_name (abfd, rel_hdr, sec_name,
use_rela_p))
return false;
rel_hdr->sh_type = use_rela_p ? SHT_RELA : SHT_REL; // Possible crash
rel_hdr->sh_entsize = (use_rela_p
? bed->s->sizeof_rela
: bed->s->sizeof_rel);
rel_hdr->sh_addralign = (bfd_vma) 1 << bed->s->log_file_align;
rel_hdr->sh_flags = 0;
rel_hdr->sh_addr = 0;
rel_hdr->sh_size = 0;
rel_hdr->sh_offset = 0;
return true;
}
DESCRIPTION: bfd_zalloc can return NULL. This is not checked, and then the result is used
HOW TO FIX: Add a check after the allocation:
If (rel_hdr == NULL) return false;
PRIORITY: low.
Jacob
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Missing check for NULL
2023-09-12 15:24 Missing check for NULL jacob navia
@ 2023-09-13 6:39 ` Alan Modra
0 siblings, 0 replies; 2+ messages in thread
From: Alan Modra @ 2023-09-13 6:39 UTC (permalink / raw)
To: jacob navia; +Cc: binutils
On Tue, Sep 12, 2023 at 05:24:03PM +0200, jacob navia wrote:
> Hi
> HOW TO FIX: Add a check after the allocation:
> If (rel_hdr == NULL) return false;
Yes.
* elf.c (_bfd_elf_init_reloc_shdr): Don't segfault on alloc fail.
diff --git a/bfd/elf.c b/bfd/elf.c
index d7109f14039..fa8881e8ea6 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -3659,6 +3659,8 @@ _bfd_elf_init_reloc_shdr (bfd *abfd,
BFD_ASSERT (reldata->hdr == NULL);
rel_hdr = bfd_zalloc (abfd, sizeof (*rel_hdr));
+ if (rel_hdr == NULL)
+ return false;
reldata->hdr = rel_hdr;
if (delay_st_name_p)
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-09-13 6:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-12 15:24 Missing check for NULL jacob navia
2023-09-13 6:39 ` Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).