aboutsummaryrefslogtreecommitdiff
path: root/bfd/elfcode.h
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2014-12-01 16:43:46 +0000
committerNick Clifton <nickc@redhat.com>2014-12-01 16:43:46 +0000
commit06614111d1be94b43ea8dd83805184d4e177bcea (patch)
tree7b83dc3944a96259e83bf4c949b237404f02c5bb /bfd/elfcode.h
parent30b5e341f3bcb219718ad32cd0065670fd37e637 (diff)
downloadgdb-06614111d1be94b43ea8dd83805184d4e177bcea.zip
gdb-06614111d1be94b43ea8dd83805184d4e177bcea.tar.gz
gdb-06614111d1be94b43ea8dd83805184d4e177bcea.tar.bz2
More fixes for memory access violations exposed by fuzzed binaries.
PR binutils/17512 * dwarf.h (struct dwarf_section): Add user_data field. * dwarf.c (frame_need_space): Check for an over large register number. (display_debug_frames): Check the return value from frame_need_space. Check for a CFA expression that is so long the start address wraps around. (debug_displays): Initialise the user_data field. * objdump.c (load_specific_debug_section): Save the BFD section pointer in the user_data field of the dwarf_section structure. (free_debug_section): Update BFD section data when freeing section contents. * readelf.c (load_specific_debug_section): Initialise the user_data field. * archive.c (do_slurp_coff_armap): Add range checks to prevent running off the end of the string table. * compress.c (bfd_get_full_section_contents): Return a NULL pointer for zero sized sections. Do not attempt to copy a buffer onto itself. * elf-attrs.c (_bfd_elf_parse_attributes): Check for an empty header. Add range checks to avoid running off the end of the section. * elf.c (bfd_elf_get_str_section): Seek before allocating so that if the seek fails, no memory is allocated. (bfd_elf_string_from_elf_section): Do not allocate a string from a non string section. It only leads to trouble later on. (_bfd_elf_print_private_bfd_data): Check for there being too little external dynamic data. (bfd_section_from_shdr): Replace assertion with a failure mode. (bfd_section_from_shdr): When walking a loaded group section use the internal structure size, not the external size. Check for the group section being empty. * elf32-i386.c (elf_i386_rtype_to_howto): Replace assertion with a failure mode. * elfcode.h (elf_slurp_reloc_table): Likewise. * reloc.c (bfd_perform_relocation): Avoid seg-fault if the howto parameter is NULL.
Diffstat (limited to 'bfd/elfcode.h')
-rw-r--r--bfd/elfcode.h4
1 files changed, 3 insertions, 1 deletions
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
index ec53c3b..d34e18e 100644
--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
@@ -1501,7 +1501,9 @@ elf_slurp_reloc_table (bfd *abfd,
rel_hdr2 = d->rela.hdr;
reloc_count2 = rel_hdr2 ? NUM_SHDR_ENTRIES (rel_hdr2) : 0;
- BFD_ASSERT (asect->reloc_count == reloc_count + reloc_count2);
+ /* PR 17512: file: 0b4f81b7. */
+ if (asect->reloc_count != reloc_count + reloc_count2)
+ return FALSE;
BFD_ASSERT ((rel_hdr && asect->rel_filepos == rel_hdr->sh_offset)
|| (rel_hdr2 && asect->rel_filepos == rel_hdr2->sh_offset));