diff options
| author | Alan Modra <amodra@gmail.com> | 2021-12-17 12:19:54 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2021-12-17 16:01:13 +1030 |
| commit | 8ef22662dcd18c6b069fee3b1a10557cb2c03af4 (patch) | |
| tree | e86d43f7ba09641f07fbc8778c3e517372eee9d8 | |
| parent | dbc6a0e2e4bdc70133d9165fb2e15b592bc27c53 (diff) | |
| download | binutils-8ef22662dcd18c6b069fee3b1a10557cb2c03af4.zip binutils-8ef22662dcd18c6b069fee3b1a10557cb2c03af4.tar.gz binutils-8ef22662dcd18c6b069fee3b1a10557cb2c03af4.tar.bz2 | |
asan: buffer overflow in elfnn-aarch64.c get_plt_type
We can't assume .dynamic is a multiple of ElfNN_External_Dyn, at least
not when presented with fuzzed object files.
* elfnn-aarch64.c (get_plt_type): Don't access past end of
improperly sized .dynamic.
| -rw-r--r-- | bfd/elfnn-aarch64.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/bfd/elfnn-aarch64.c b/bfd/elfnn-aarch64.c index 4885f41..051aff5 100644 --- a/bfd/elfnn-aarch64.c +++ b/bfd/elfnn-aarch64.c @@ -9762,11 +9762,13 @@ get_plt_type (bfd *abfd) aarch64_plt_type ret = PLT_NORMAL; bfd_byte *contents, *extdyn, *extdynend; asection *sec = bfd_get_section_by_name (abfd, ".dynamic"); - if (!sec || !bfd_malloc_and_get_section (abfd, sec, &contents)) + if (!sec + || sec->size < sizeof (ElfNN_External_Dyn) + || !bfd_malloc_and_get_section (abfd, sec, &contents)) return ret; extdyn = contents; - extdynend = contents + sec->size; - for (; extdyn < extdynend; extdyn += sizeof (ElfNN_External_Dyn)) + extdynend = contents + sec->size - sizeof (ElfNN_External_Dyn); + for (; extdyn <= extdynend; extdyn += sizeof (ElfNN_External_Dyn)) { Elf_Internal_Dyn dyn; bfd_elfNN_swap_dyn_in (abfd, extdyn, &dyn); |