diff options
| author | Yuriy M. Kaminskiy <yumkam@gmail.com> | 2015-08-04 16:51:53 +0100 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2015-08-04 16:51:53 +0100 |
| commit | 7e27a9d5f22f9f7ead11738b1546d0b5c737266b (patch) | |
| tree | 46bffdfecd821e8f439790cab4da495658777807 /binutils | |
| parent | 4e13f8fb05eb7ffd163d96e519cc011d8d21e3d7 (diff) | |
| download | fsf-binutils-gdb-7e27a9d5f22f9f7ead11738b1546d0b5c737266b.zip fsf-binutils-gdb-7e27a9d5f22f9f7ead11738b1546d0b5c737266b.tar.gz fsf-binutils-gdb-7e27a9d5f22f9f7ead11738b1546d0b5c737266b.tar.bz2 | |
Fix stack buffer overflows when parsing corrupt ihex files.
PR binutils/18750
* ihex.c (ihex_scan): Fixes incorrect escape sequence in error message
and stack overflow when char is signed and \200-\376 was in place of hex
digit; also fixes \377 was handled as EOF instead of "incorrect character".
(ihex_read_section): Changed for consistency.
(ihex_bad_byte): Prevent (now impossible to trigger) stack
overflow and incorrect escape sequence handling.
* srec.c (srec_bad_byte): Likewise.
* readelf.c (process_mips_specific): Fix incorrect escape
sequence handling.
Diffstat (limited to 'binutils')
| -rw-r--r-- | binutils/ChangeLog | 11 | ||||
| -rw-r--r-- | binutils/readelf.c | 2 |
2 files changed, 12 insertions, 1 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog index 75f5d21..33c5e7d 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,14 @@ +2015-08-04 Yuriy M. Kaminskiy" <yumkam@gmail.com> + Tyler Hicks <tyhicks@canonical.com> + + PR binutils/18750 + * readelf.c (process_mips_specific): Fix incorrect escape + sequence handling. + +2015-08-04 Nick Clifton <nickc@redhat.com> + + * ar.c (extract_file): Free cbuf if the path is invalid. + 2015-07-27 H.J. Lu <hongjiu.lu@intel.com> * configure: Regenerated. diff --git a/binutils/readelf.c b/binutils/readelf.c index a9b9f2d..6298f1e 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -14467,7 +14467,7 @@ process_mips_specific (FILE * file) len = sizeof (* eopt); while (len < option->size) { - char datum = * ((char *) eopt + offset + len); + unsigned char datum = * ((unsigned char *) eopt + offset + len); if (ISPRINT (datum)) printf ("%c", datum); |