aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2023-08-21 18:38:08 +0930
committerAlan Modra <amodra@gmail.com>2023-08-21 19:11:02 +0930
commitfa62aafb7d81b89d68752e830a757ef4199d0b21 (patch)
treeca6445fa26e49fb473aaaf82f94d8e8a1aec5090 /include
parent51939d713fc2121f5b92514606c014dfbb47275f (diff)
downloadbinutils-fa62aafb7d81b89d68752e830a757ef4199d0b21.zip
binutils-fa62aafb7d81b89d68752e830a757ef4199d0b21.tar.gz
binutils-fa62aafb7d81b89d68752e830a757ef4199d0b21.tar.bz2
bfd_close_all_done bug and bfd_last_cache
bfd_close ought to always call iovec->bclose so that cache_bclose is called. If not, bfd_last_cache will be left pointing at freed memory. This bug was found by oss-fuzz with the trigger being an old bug in the ia64-vms support. Given a file of the "wrong" size, elf64_vms_close_and_cleanup attempted to extend it, leading to an error since the file was opened read-only by nm. nm bad_file bad_file then hit the use-after-free when opening the second file. commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and bfd_close_all_done, but didn't go quite far enough. * elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't attempt to extend read-only files. * opncls.c (bfd_close_all_done): Always call _close_and_cleanup. An old bug in the ia64-vms support can be used to tickle another bug in bfd_close_all_done. If _close_and_cleanup returns an error,
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions