aboutsummaryrefslogtreecommitdiff
path: root/bfd/elf-attrs.c
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2014-12-09 12:42:18 +0000
committerNick Clifton <nickc@redhat.com>2014-12-09 12:42:18 +0000
commitf64e188b58f4aab4cbd03aa6e9fc1aa602546e26 (patch)
tree46d8f90891842ce15eee893ce5489835e9e65a20 /bfd/elf-attrs.c
parent137d1369ac054744d27f19e95aa8a739e6c0068d (diff)
downloadgdb-f64e188b58f4aab4cbd03aa6e9fc1aa602546e26.zip
gdb-f64e188b58f4aab4cbd03aa6e9fc1aa602546e26.tar.gz
gdb-f64e188b58f4aab4cbd03aa6e9fc1aa602546e26.tar.bz2
More fixes for memory access violations triggered by fuzzed binaries.
PR binutils/17512 * objdump.c (display_any_bfd): Avoid infinite loop closing and opening the same archive again and again. * archive64.c (bfd_elf64_archive_slurp_armap): Add range checks. * libbfd.c (safe_read_leb128): New function. * libbfd-in.h (safe_read_leb128): Add prototype. * libbfd.h: Regenerate. * elf-attrs.c (_bfd_elf_parse_attributes): Use safe_read_leb128. Check for an over-long subsection length. * elf.c (elf_parse_notes): Check that the namedata is long enough for the string comparison that is about to be performed. (elf_read_notes): Zero-terminate the note buffer.
Diffstat (limited to 'bfd/elf-attrs.c')
-rw-r--r--bfd/elf-attrs.c15
1 files changed, 9 insertions, 6 deletions
diff --git a/bfd/elf-attrs.c b/bfd/elf-attrs.c
index 25f7e26..8f76b6a 100644
--- a/bfd/elf-attrs.c
+++ b/bfd/elf-attrs.c
@@ -492,7 +492,7 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
bfd_vma subsection_len;
bfd_byte *end;
- tag = read_unsigned_leb128 (abfd, p, &n);
+ tag = safe_read_leb128 (abfd, p, &n, FALSE, p_end);
p += n;
if (p < p_end - 4)
subsection_len = bfd_get_32 (abfd, p);
@@ -506,6 +506,9 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
section_len -= subsection_len;
subsection_len -= n + 4;
end = p + subsection_len;
+ /* PR 17512: file: 0e8c0c90. */
+ if (end > p_end)
+ end = p_end;
switch (tag)
{
case Tag_File:
@@ -513,25 +516,25 @@ _bfd_elf_parse_attributes (bfd *abfd, Elf_Internal_Shdr * hdr)
{
int type;
- tag = read_unsigned_leb128 (abfd, p, &n);
+ tag = safe_read_leb128 (abfd, p, &n, FALSE, end);
p += n;
type = _bfd_elf_obj_attrs_arg_type (abfd, vendor, tag);
switch (type & (ATTR_TYPE_FLAG_INT_VAL | ATTR_TYPE_FLAG_STR_VAL))
{
case ATTR_TYPE_FLAG_INT_VAL | ATTR_TYPE_FLAG_STR_VAL:
- val = read_unsigned_leb128 (abfd, p, &n);
+ val = safe_read_leb128 (abfd, p, &n, FALSE, end);
p += n;
bfd_elf_add_obj_attr_int_string (abfd, vendor, tag,
- val, (char *)p);
+ val, (char *) p);
p += strlen ((char *)p) + 1;
break;
case ATTR_TYPE_FLAG_STR_VAL:
bfd_elf_add_obj_attr_string (abfd, vendor, tag,
- (char *)p);
+ (char *) p);
p += strlen ((char *)p) + 1;
break;
case ATTR_TYPE_FLAG_INT_VAL:
- val = read_unsigned_leb128 (abfd, p, &n);
+ val = safe_read_leb128 (abfd, p, &n, FALSE, end);
p += n;
bfd_elf_add_obj_attr_int (abfd, vendor, tag, val);
break;