diff options
| author | Nick Clifton <nickc@redhat.com> | 2018-08-23 11:45:38 +0100 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2018-08-23 11:45:38 +0100 |
| commit | 334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e (patch) | |
| tree | 576737b73ff9722702d9c38ea4d56f1df000cb9b /bfd/coffgen.c | |
| parent | d0abeec8d45514fbec790f27e3cadceb576df9b5 (diff) | |
| download | gdb-334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e.zip gdb-334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e.tar.gz gdb-334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e.tar.bz2 | |
Prevent illegal memory access when processing COFF auxillary symbol information.
PR 23061
* coffgen.c (coff_pointerize_aux): Add table_end parameter. Use
it to prevent walking off the end of the table.
(coff_get_normalized_symtab): Pass internal_end pointer to
coff_pointerize_aux.
Diffstat (limited to 'bfd/coffgen.c')
| -rw-r--r-- | bfd/coffgen.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/bfd/coffgen.c b/bfd/coffgen.c index b9e4872..9e62feb 100644 --- a/bfd/coffgen.c +++ b/bfd/coffgen.c @@ -1521,7 +1521,8 @@ coff_pointerize_aux (bfd *abfd, combined_entry_type *table_base, combined_entry_type *symbol, unsigned int indaux, - combined_entry_type *auxent) + combined_entry_type *auxent, + combined_entry_type *table_end) { unsigned int type = symbol->u.syment.n_type; unsigned int n_sclass = symbol->u.syment.n_sclass; @@ -1549,16 +1550,20 @@ coff_pointerize_aux (bfd *abfd, || n_sclass == C_FCN) && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0 && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l - < (long) obj_raw_syment_count (abfd)) + < (long) obj_raw_syment_count (abfd) + && table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l + < table_end) { auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.p = table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l; auxent->fix_end = 1; } + /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can generate one, so we must be careful to ignore it. */ if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l - < obj_raw_syment_count (abfd)) + < obj_raw_syment_count (abfd) + && table_base + auxent->u.auxent.x_sym.x_tagndx.l < table_end) { auxent->u.auxent.x_sym.x_tagndx.p = table_base + auxent->u.auxent.x_sym.x_tagndx.l; @@ -1869,7 +1874,7 @@ coff_get_normalized_symtab (bfd *abfd) internal_ptr->is_sym = FALSE; coff_pointerize_aux (abfd, internal, symbol_ptr, i, - internal_ptr); + internal_ptr, internal_end); } } |