diff options
| author | Alan Modra <amodra@gmail.com> | 2023-08-21 18:38:08 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2023-08-21 19:11:02 +0930 |
| commit | fa62aafb7d81b89d68752e830a757ef4199d0b21 (patch) | |
| tree | ca6445fa26e49fb473aaaf82f94d8e8a1aec5090 /bfd | |
| parent | 51939d713fc2121f5b92514606c014dfbb47275f (diff) | |
| download | gdb-fa62aafb7d81b89d68752e830a757ef4199d0b21.zip gdb-fa62aafb7d81b89d68752e830a757ef4199d0b21.tar.gz gdb-fa62aafb7d81b89d68752e830a757ef4199d0b21.tar.bz2 | |
bfd_close_all_done bug and bfd_last_cache
bfd_close ought to always call iovec->bclose so that cache_bclose is
called. If not, bfd_last_cache will be left pointing at freed memory.
This bug was found by oss-fuzz with the trigger being an old bug in
the ia64-vms support. Given a file of the "wrong" size,
elf64_vms_close_and_cleanup attempted to extend it, leading to an
error since the file was opened read-only by nm. nm bad_file bad_file
then hit the use-after-free when opening the second file.
commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and
bfd_close_all_done, but didn't go quite far enough.
* elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't
attempt to extend read-only files.
* opncls.c (bfd_close_all_done): Always call _close_and_cleanup.
An old bug in the ia64-vms support can be used to tickle another bug
in bfd_close_all_done. If _close_and_cleanup returns an error,
Diffstat (limited to 'bfd')
| -rw-r--r-- | bfd/elf64-ia64-vms.c | 3 | ||||
| -rw-r--r-- | bfd/opncls.c | 10 |
2 files changed, 6 insertions, 7 deletions
diff --git a/bfd/elf64-ia64-vms.c b/bfd/elf64-ia64-vms.c index f8e9922..ab1f18b 100644 --- a/bfd/elf64-ia64-vms.c +++ b/bfd/elf64-ia64-vms.c @@ -4713,7 +4713,8 @@ static bool elf64_vms_close_and_cleanup (bfd *abfd) { bool ret = true; - if (bfd_get_format (abfd) == bfd_object) + if (bfd_get_format (abfd) == bfd_object + && bfd_write_p (abfd)) { long isize; diff --git a/bfd/opncls.c b/bfd/opncls.c index 56a9004..741d20e 100644 --- a/bfd/opncls.c +++ b/bfd/opncls.c @@ -920,13 +920,11 @@ bfd_close_all_done (bfd *abfd) { bool ret = BFD_SEND (abfd, _close_and_cleanup, (abfd)); - if (ret && abfd->iovec != NULL) - { - ret = abfd->iovec->bclose (abfd) == 0; + if (abfd->iovec != NULL) + ret &= abfd->iovec->bclose (abfd) == 0; - if (ret) - _maybe_make_executable (abfd); - } + if (ret) + _maybe_make_executable (abfd); _bfd_delete_bfd (abfd); free (_bfd_error_buf); |