diff options
| author | Nick Clifton <nickc@redhat.com> | 2017-06-22 10:33:56 +0100 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2017-06-22 10:33:56 +0100 |
| commit | d19237d98d5c227bc33693057eb466702386cdfb (patch) | |
| tree | fb42ede315655bb10531d4c24a3a594f08883408 | |
| parent | e7d39ed3e0ca36d0dbd6ddd4cb955aa73b0974e6 (diff) | |
| download | fsf-binutils-gdb-d19237d98d5c227bc33693057eb466702386cdfb.zip fsf-binutils-gdb-d19237d98d5c227bc33693057eb466702386cdfb.tar.gz fsf-binutils-gdb-d19237d98d5c227bc33693057eb466702386cdfb.tar.bz2 | |
Fix address violation parsing a corrupt SOM binary.
PR binutils/21649
* som.c (setup_sections): NUL terminate the space_strings buffer.
Check that the space.name field does not index beyond the end of
the space_strings buffer.
| -rw-r--r-- | bfd/ChangeLog | 7 | ||||
| -rw-r--r-- | bfd/som.c | 9 |
2 files changed, 14 insertions, 2 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index b1cf4f9..57a07a5 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,10 @@ +2017-06-22 Nick Clifton <nickc@redhat.com> + + PR binutils/21649 + * som.c (setup_sections): NUL terminate the space_strings buffer. + Check that the space.name field does not index beyond the end of + the space_strings buffer. + 2017-06-21 Nick Clifton <nickc@redhat.com> PR binutils/21646 @@ -2083,8 +2083,8 @@ setup_sections (bfd *abfd, /* First, read in space names. */ amt = file_hdr->space_strings_size; - space_strings = bfd_malloc (amt); - if (!space_strings && amt != 0) + space_strings = bfd_malloc (amt + 1); + if (space_strings == NULL && amt != 0) goto error_return; if (bfd_seek (abfd, current_offset + file_hdr->space_strings_location, @@ -2092,6 +2092,8 @@ setup_sections (bfd *abfd, goto error_return; if (bfd_bread (space_strings, amt, abfd) != amt) goto error_return; + /* Make sure that the string table is NUL terminated. */ + space_strings[amt] = 0; /* Loop over all of the space dictionaries, building up sections. */ for (space_index = 0; space_index < file_hdr->space_total; space_index++) @@ -2119,6 +2121,9 @@ setup_sections (bfd *abfd, som_swap_space_dictionary_in (&ext_space, &space); /* Setup the space name string. */ + if (space.name >= file_hdr->space_strings_size) + goto error_return; + space_name = space.name + space_strings; /* Make a section out of it. */ |