diff options
| author | Alan Modra <amodra@gmail.com> | 2023-02-02 22:39:31 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2023-02-03 16:11:18 +1030 |
| commit | 96e034530e092e8b746e00d13086c1138a84504b (patch) | |
| tree | 3c5d4b47c37dd6e90a3319ec5e72a03fe40799a5 | |
| parent | e0df1fd7842d93495e7b382dc969d7347b53b7bf (diff) | |
| download | binutils-96e034530e092e8b746e00d13086c1138a84504b.zip binutils-96e034530e092e8b746e00d13086c1138a84504b.tar.gz binutils-96e034530e092e8b746e00d13086c1138a84504b.tar.bz2 | |
Add ECOFF Symbolic Header sanity checks
Anti-fuzzer measures. The checks don't ensure the various elements in
the header are distinct, but that isn't important as far as making
sure we don't overrun the buffer containing all the elements. Also,
we now don't care about offsets where the corresponding count is zero.
* ecoff.c (_bfd_ecoff_slurp_symbolic_info): Sanity check offsets
in debug->symbolic_header.
| -rw-r--r-- | bfd/ecoff.c | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/bfd/ecoff.c b/bfd/ecoff.c index 717d2fa..48f33df 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -527,12 +527,24 @@ _bfd_ecoff_slurp_symbolic_info (bfd *abfd, documented section. And the ordering of the sections varies between statically and dynamically linked executables. If bfd supports SEEK_END someday, this code could be simplified. */ - raw_end = 0; + raw_end = raw_base; #define UPDATE_RAW_END(start, count, size) \ - cb_end = internal_symhdr->start + internal_symhdr->count * (size); \ - if (cb_end > raw_end) \ - raw_end = cb_end + do \ + if (internal_symhdr->count != 0) \ + { \ + if (internal_symhdr->start < raw_base) \ + goto err; \ + if (_bfd_mul_overflow ((unsigned long) internal_symhdr->count, \ + (size), &amt)) \ + goto err; \ + cb_end = internal_symhdr->start + amt; \ + if (cb_end < internal_symhdr->start) \ + goto err; \ + if (cb_end > raw_end) \ + raw_end = cb_end; \ + } \ + while (0) UPDATE_RAW_END (cbLineOffset, cbLine, sizeof (unsigned char)); UPDATE_RAW_END (cbDnOffset, idnMax, backend->debug_swap.external_dnr_size); @@ -599,6 +611,7 @@ _bfd_ecoff_slurp_symbolic_info (bfd *abfd, if (_bfd_mul_overflow ((unsigned long) internal_symhdr->ifdMax, sizeof (struct fdr), &amt)) { + err: bfd_set_error (bfd_error_file_too_big); return false; } |