diff options
| author | Alan Modra <amodra@gmail.com> | 2021-05-18 23:39:35 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2021-05-19 11:07:17 +0930 |
| commit | 9d9e2a340ba50670f406afa314acaa9a2c34ec64 (patch) | |
| tree | bcc32796dccb71d476a428b785d0a9ab5222f7af /binutils | |
| parent | 75933ce3d95005bf763fa5c1275725aa6c591dc1 (diff) | |
| download | fsf-binutils-gdb-9d9e2a340ba50670f406afa314acaa9a2c34ec64.zip fsf-binutils-gdb-9d9e2a340ba50670f406afa314acaa9a2c34ec64.tar.gz fsf-binutils-gdb-9d9e2a340ba50670f406afa314acaa9a2c34ec64.tar.bz2 | |
PR27879, stack-buffer-overflow on sysdump
PR 27879
* sysdump.c (getBARRAY): Sanity check size against max.
(getINT): Avoid UB shift left.
Diffstat (limited to 'binutils')
| -rw-r--r-- | binutils/ChangeLog | 6 | ||||
| -rw-r--r-- | binutils/sysdump.c | 13 |
2 files changed, 14 insertions, 5 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog index 3819a42..6767729 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2021-05-19 Alan Modra <amodra@gmail.com> + + PR 27879 + * sysdump.c (getBARRAY): Sanity check size against max. + (getINT): Avoid UB shift left. + 2021-05-15 Alan Modra <amodra@gmail.com> * dwarf.c (process_cu_tu_index): Avoid pointer UB. Use _mul_overflow. diff --git a/binutils/sysdump.c b/binutils/sysdump.c index 8993152..35796e8 100644 --- a/binutils/sysdump.c +++ b/binutils/sysdump.c @@ -131,19 +131,21 @@ fillup (unsigned char *ptr) } static barray -getBARRAY (unsigned char *ptr, int *idx, int dsize ATTRIBUTE_UNUSED, - int max ATTRIBUTE_UNUSED) +getBARRAY (unsigned char *ptr, int *idx, int dsize ATTRIBUTE_UNUSED, int max) { barray res; int i; int byte = *idx / 8; - int size = ptr[byte++]; + int size = 0; + + if (byte < max) + size = ptr[byte++]; res.len = size; res.data = (unsigned char *) xmalloc (size); for (i = 0; i < size; i++) - res.data[i] = ptr[byte++]; + res.data[i] = byte < max ? ptr[byte++] : 0; return res; } @@ -179,7 +181,8 @@ getINT (unsigned char *ptr, int *idx, int size, int max) n = (ptr[byte + 0] << 8) + ptr[byte + 1]; break; case 4: - n = (ptr[byte + 0] << 24) + (ptr[byte + 1] << 16) + (ptr[byte + 2] << 8) + (ptr[byte + 3]); + n = (((unsigned) ptr[byte + 0] << 24) + (ptr[byte + 1] << 16) + + (ptr[byte + 2] << 8) + (ptr[byte + 3])); break; default: fatal (_("Unsupported read size: %d"), size); |