diff options
| author | Alan Modra <amodra@gmail.com> | 2020-09-04 19:19:18 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2020-09-04 19:29:02 +0930 |
| commit | 8642dafaef21aa6747cec01df1977e9c52eb4679 (patch) | |
| tree | 7674ac87fdb82a435b63f9d60355a901bfebc3b6 /bfd/elfcode.h | |
| parent | 1e3b96fd6cf0c7d018083994ad951ccf92aba582 (diff) | |
| download | gdb-8642dafaef21aa6747cec01df1977e9c52eb4679.zip gdb-8642dafaef21aa6747cec01df1977e9c52eb4679.tar.gz gdb-8642dafaef21aa6747cec01df1977e9c52eb4679.tar.bz2 | |
PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_section
A horribly fuzzed object with section headers inside the ELF header.
Disallow that, and crazy reloc sizes.
PR 26574
* elfcode.h (elf_object_p): Sanity check section header offset.
* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
sh_entsize.
Diffstat (limited to 'bfd/elfcode.h')
| -rw-r--r-- | bfd/elfcode.h | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/bfd/elfcode.h b/bfd/elfcode.h index 2ed2f13..606ff64 100644 --- a/bfd/elfcode.h +++ b/bfd/elfcode.h @@ -571,7 +571,7 @@ elf_object_p (bfd *abfd) /* If this is a relocatable file and there is no section header table, then we're hosed. */ - if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL) + if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL) goto got_wrong_format_error; /* As a simple sanity check, verify that what BFD thinks is the @@ -581,7 +581,7 @@ elf_object_p (bfd *abfd) goto got_wrong_format_error; /* Further sanity check. */ - if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0) + if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0) goto got_wrong_format_error; ebd = get_elf_backend_data (abfd); @@ -618,7 +618,7 @@ elf_object_p (bfd *abfd) && ebd->elf_osabi != ELFOSABI_NONE) goto got_wrong_format_error; - if (i_ehdrp->e_shoff != 0) + if (i_ehdrp->e_shoff >= sizeof (x_ehdr)) { file_ptr where = (file_ptr) i_ehdrp->e_shoff; @@ -819,7 +819,7 @@ elf_object_p (bfd *abfd) } } - if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0) + if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr)) { unsigned int num_sec; |