* asan: NULL dereference in _bfd_mips_final_write_processing
@ 2024-02-07 12:14 Alan Modra
0 siblings, 0 replies; only message in thread
From: Alan Modra @ 2024-02-07 12:14 UTC (permalink / raw)
To: binutils
Fuzzed object files can easily have unexpected section names. We
don't want to segfault on objcopy of any file accepted by the mips
object_p functions. For objcopy, an assertion that "sec" is non-NULL
followed by deferencing "sec" is wrong. So too is asserting that the
section name string starts with a particular prefix, and then blithely
accessing past the assumed prefix.
* elfxx-mips.c (_bfd_mips_final_write_processing): Replace
assertions with conditionals. Don't bother testing for name
non-NULL.
diff --git a/bfd/elfxx-mips.c b/bfd/elfxx-mips.c
index 69dd71419ff..b888e7622b7 100644
--- a/bfd/elfxx-mips.c
+++ b/bfd/elfxx-mips.c
@@ -12529,22 +12529,24 @@ _bfd_mips_final_write_processing (bfd *abfd)
case SHT_MIPS_GPTAB:
BFD_ASSERT ((*hdrpp)->bfd_section != NULL);
name = bfd_section_name ((*hdrpp)->bfd_section);
- BFD_ASSERT (name != NULL
- && startswith (name, ".gptab."));
- sec = bfd_get_section_by_name (abfd, name + sizeof ".gptab" - 1);
- BFD_ASSERT (sec != NULL);
- (*hdrpp)->sh_info = elf_section_data (sec)->this_idx;
+ if (startswith (name, ".gptab."))
+ {
+ sec = bfd_get_section_by_name (abfd, name + sizeof ".gptab" - 1);
+ if (sec != NULL)
+ (*hdrpp)->sh_info = elf_section_data (sec)->this_idx;
+ }
break;
case SHT_MIPS_CONTENT:
BFD_ASSERT ((*hdrpp)->bfd_section != NULL);
name = bfd_section_name ((*hdrpp)->bfd_section);
- BFD_ASSERT (name != NULL
- && startswith (name, ".MIPS.content"));
- sec = bfd_get_section_by_name (abfd,
- name + sizeof ".MIPS.content" - 1);
- BFD_ASSERT (sec != NULL);
- (*hdrpp)->sh_link = elf_section_data (sec)->this_idx;
+ if (startswith (name, ".MIPS.content"))
+ {
+ sec = bfd_get_section_by_name (abfd,
+ name + sizeof ".MIPS.content" - 1);
+ if (sec != NULL)
+ (*hdrpp)->sh_link = elf_section_data (sec)->this_idx;
+ }
break;
case SHT_MIPS_SYMBOL_LIB:
@@ -12559,19 +12561,16 @@ _bfd_mips_final_write_processing (bfd *abfd)
case SHT_MIPS_EVENTS:
BFD_ASSERT ((*hdrpp)->bfd_section != NULL);
name = bfd_section_name ((*hdrpp)->bfd_section);
- BFD_ASSERT (name != NULL);
if (startswith (name, ".MIPS.events"))
sec = bfd_get_section_by_name (abfd,
name + sizeof ".MIPS.events" - 1);
+ else if (startswith (name, ".MIPS.post_rel"))
+ sec = bfd_get_section_by_name (abfd,
+ name + sizeof ".MIPS.post_rel" - 1);
else
- {
- BFD_ASSERT (startswith (name, ".MIPS.post_rel"));
- sec = bfd_get_section_by_name (abfd,
- (name
- + sizeof ".MIPS.post_rel" - 1));
- }
- BFD_ASSERT (sec != NULL);
- (*hdrpp)->sh_link = elf_section_data (sec)->this_idx;
+ sec = NULL;
+ if (sec != NULL)
+ (*hdrpp)->sh_link = elf_section_data (sec)->this_idx;
break;
case SHT_MIPS_XHASH:
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-02-07 12:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-07 12:14 asan: NULL dereference in _bfd_mips_final_write_processing Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).