public inbox for gdb-testers@sourceware.org
help / color / mirror / Atom feed
* [binutils-gdb] Limit bogus archive parsed_size
@ 2020-03-09 10:46 gdb-buildbot
  2020-03-09 10:46 ` Failures on Fedora-i686, branch master gdb-buildbot
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: gdb-buildbot @ 2020-03-09 10:46 UTC (permalink / raw)
  To: gdb-testers

*** TEST RESULTS FOR COMMIT b570b954bc5c1d6a6edb363c7bdba814bc1fd174 ***

commit b570b954bc5c1d6a6edb363c7bdba814bc1fd174
Author:     Alan Modra <amodra@gmail.com>
AuthorDate: Tue Feb 25 12:48:43 2020 +1030
Commit:     Alan Modra <amodra@gmail.com>
CommitDate: Wed Feb 26 10:37:13 2020 +1030

    Limit bogus archive parsed_size
    
    Archive element size is given by data in the archive, and thus is
    subject to attack by fuzzers.  The only harm this allows is allocation
    of huge amounts of memory, but some systems don't handle that well.
    So limit archive element size to archive file size.
    
            * bfdio.c (bfd_get_file_size): Ignore bogus archive element sizes.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 7e8e454632..5855df7c6b 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,7 @@
+2020-02-26  Alan Modra  <amodra@gmail.com>
+
+	* bfdio.c (bfd_get_file_size): Ignore bogus archive element sizes.
+
 2020-02-25  H.J. Lu  <hongjiu.lu@intel.com>
 
 	PR binutils/25584
diff --git a/bfd/bfdio.c b/bfd/bfdio.c
index 49e0958526..71ac17ec51 100644
--- a/bfd/bfdio.c
+++ b/bfd/bfdio.c
@@ -25,6 +25,7 @@
 #include <limits.h>
 #include "bfd.h"
 #include "libbfd.h"
+#include "aout/ar.h"
 
 #ifndef S_IXUSR
 #define S_IXUSR 0100    /* Execute by owner.  */
@@ -460,11 +461,24 @@ DESCRIPTION
 ufile_ptr
 bfd_get_file_size (bfd *abfd)
 {
+  ufile_ptr file_size, archive_size = (ufile_ptr) -1;
+
   if (abfd->my_archive != NULL
       && !bfd_is_thin_archive (abfd->my_archive))
-    return arelt_size (abfd);
+    {
+      struct areltdata *adata = (struct areltdata *) abfd->arelt_data;
+      archive_size = adata->parsed_size;
+      /* If the archive is compressed we can't compare against file size.  */
+      if (memcmp (((struct ar_hdr *) adata->arch_header)->ar_fmag,
+		  "Z\012", 2) == 0)
+	return archive_size;
+      abfd = abfd->my_archive;
+    }
 
-  return bfd_get_size (abfd);
+  file_size = bfd_get_size (abfd);
+  if (archive_size < file_size)
+    return archive_size;
+  return file_size;
 }
 
 /*


^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-03-12  1:01 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-09 10:46 [binutils-gdb] Limit bogus archive parsed_size gdb-buildbot
2020-03-09 10:46 ` Failures on Fedora-i686, branch master gdb-buildbot
2020-03-09 11:48 ` Failures on Fedora-x86_64-m64, " gdb-buildbot
2020-03-09 12:26 ` Failures on Fedora-x86_64-native-extended-gdbserver-m64, " gdb-buildbot
2020-03-09 12:28 ` Failures on Fedora-x86_64-native-extended-gdbserver-m32, " gdb-buildbot
2020-03-10 20:57 ` Failures on Fedora-x86_64-native-gdbserver-m64, " gdb-buildbot
2020-03-12  1:01 ` Failures on Fedora-x86_64-native-gdbserver-m32, " gdb-buildbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).