diff options
| author | Alan Modra <amodra@gmail.com> | 2024-11-30 16:41:14 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2024-12-01 16:43:15 +1030 |
| commit | 8ab91a033555c5faae1bcd615800670b91673731 (patch) | |
| tree | e01d09f233d88223dfedc7403a0e8ea0b4906066 /binutils/bucomm.c | |
| parent | 227146c286e894a8886965a7576a70a451058ae5 (diff) | |
| download | binutils-8ab91a033555c5faae1bcd615800670b91673731.zip binutils-8ab91a033555c5faae1bcd615800670b91673731.tar.gz binutils-8ab91a033555c5faae1bcd615800670b91673731.tar.bz2 | |
Re: PR32399, buffer overflow printing core_file_failing_command
Fix more potential buffer overflows, and correct trad-code.c and
cisco-core.c where they should be using bfd_{z}alloc rather than
bfd_{z}malloc. To stop buffer overflows with fuzzed objects that
don't have a terminator on the core_file_failing_command string, this
patch allocates an extra byte at the end of the entire header buffer
rather than poking a NUL at the end of the name array (u_comm[] or
similar) because (a) it's better to not overwrite the file data, and
(b) it is possible that some core files make use of fields in struct
user beyond the end of u_comm to extend the command name. The patch
also changes some unnecessary uses of bfd_zalloc to bfd_alloc.
There's not much point in clearing memeory that will shortly be
completely overwritten.
PR 32399
* aix5ppc-core.c (xcoff64_core_p): Allocate an extra byte to
ensure the core_file_failing_command string is terminated.
* netbsd-core.c (netbsd_core_file_p): Likewise.
* ptrace-core.c (ptrace_unix_core_file_p): Likewise.
* rs6000-core.c (rs6000coff_core_p): Likewise.
* trad-core.c (trad_unix_core_file_p): Likewise, and bfd_alloc
tdata rather than bfd_zmalloc.
* cisco-core.c (cisco_core_file_validate): bfd_zalloc tdata.
Diffstat (limited to 'binutils/bucomm.c')
0 files changed, 0 insertions, 0 deletions