diff options
| author | Alan Modra <amodra@gmail.com> | 2020-09-25 10:05:57 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2020-09-25 11:55:01 +0930 |
| commit | 5a805384b831e5946cc8dae13a75617cb4b9c080 (patch) | |
| tree | 52cc7d1c1aad1e515c72a29fee10302c3fdcb067 /binutils/readelf.c | |
| parent | cc9ea2c21cd6e2c88995a7484d2c848c7d7ce71b (diff) | |
| download | gdb-5a805384b831e5946cc8dae13a75617cb4b9c080.zip gdb-5a805384b831e5946cc8dae13a75617cb4b9c080.tar.gz gdb-5a805384b831e5946cc8dae13a75617cb4b9c080.tar.bz2 | |
asan: readelf buffer overflow and abort
* elfcomm.c (byte_put_little_endian, byte_put_big_endian): Support
more field sizes.
* readelf.c (target_specific_reloc_handling <MSP430>): Limit
allowed reloc_size. Don't read_leb128 outside of section.
Diffstat (limited to 'binutils/readelf.c')
| -rw-r--r-- | binutils/readelf.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/binutils/readelf.c b/binutils/readelf.c index 95720ea..9ba4e29 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -12622,7 +12622,7 @@ target_specific_reloc_handling (Filedata * filedata, if (saved_sym != NULL) { bfd_vma value; - unsigned int reloc_size; + unsigned int reloc_size = 0; int leb_ret = 0; switch (reloc_type) { @@ -12631,15 +12631,16 @@ target_specific_reloc_handling (Filedata * filedata, break; case 11: /* R_MSP430_GNU_SET_ULEB128 */ case 22: /* R_MSP430X_GNU_SET_ULEB128 */ - read_leb128 (start + reloc->r_offset, end, FALSE, - &reloc_size, &leb_ret); + if (reloc->r_offset < (size_t) (end - start)) + read_leb128 (start + reloc->r_offset, end, FALSE, + &reloc_size, &leb_ret); break; default: reloc_size = 2; break; } - if (leb_ret != 0) + if (leb_ret != 0 || reloc_size == 0 || reloc_size > 8) error (_("MSP430 ULEB128 field at 0x%lx contains invalid " "ULEB128 value\n"), (long) reloc->r_offset); |