diff options
author | Nick Clifton <nickc@redhat.com> | 2014-11-21 21:44:04 +0000 |
---|---|---|
committer | Nick Clifton <nickc@redhat.com> | 2014-11-21 21:44:04 +0000 |
commit | 0a9d414aa114b7b7e609cbcbc285f79031bbe608 (patch) | |
tree | bca8497bf5147c53a4fd786ecf96c44a83906418 /bfd/libieee.h | |
parent | 5974eba65b82912621ac68f2c0ff844efbd02b25 (diff) | |
download | gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.zip gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.tar.gz gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.tar.bz2 |
Fixes for memory access violations exposed by fuzzinf various binaries.
PR binutils/17512
* dwarf.c (get_encoded_value): Check for an encoded size of 0.
(display_debug_lines_raw): Check for an invalid line range value.
(display_debug_frames): Check for corrupt augmentation data.
* coffgen.c (coff_get_normalized_symtab): Check for an excessive
number of auxillary entries.
* ieee.c (next_byte): Convert to a function. Return FALSE if the
next byte is beyond the end of the buffer.
(parse_int): Test the return value of next_byte.
(parse_expression): Convert to boolean. Return FALSE if the
parsing failed. Test the return value of next_byte.
(ieee_seek): Convert to a function. Return FALSE if the seek goes
beyond the end of the buffer.
(ieee_slurp_external_symbols): Test the return value of ieee_seek
and next_byte.
(ieee_slurp_sections): Convert to boolean. Return FALSE if the
operation failed. Test the return value of ieee_seek and
next_byte.
(ieee_archive_p): Test the return value of ieee_seek and
next_byte.
(do_one): Likewise.
(ieee_slurp_section_data): Likewise.
(ieee_object_p): Likewise. Store the size of the buffer in the
total_amt field in the header.
* libieee.h (common_header_type): Add amt field.
* mach-o.c (bfd_mach_o_canonicalize_one_reloc): Check that the
reloc's value is within range.
(bfd_mach_o_read_symtab_symbols): Nullify the symbols field if the
operation fails.
* pei-x86_64.c (pex64_xdata_print_uwd_codes): Replace abort with
an error message.
(pex64_dump_xdata): Check for buffer overflows.
* versados.c (process_otr): Check that the section exists before
taking its size.
(versados_object_p): Make sure that enough data was read for the
header to be checked.
* vms-alpha.c (vms_get_remaining_object_record): Change
read_so_far parameter to an unsigned int. Check that the amount
read is in range.
Diffstat (limited to 'bfd/libieee.h')
-rw-r--r-- | bfd/libieee.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/bfd/libieee.h b/bfd/libieee.h index 7026b85..27fd467 100644 --- a/bfd/libieee.h +++ b/bfd/libieee.h @@ -66,6 +66,7 @@ typedef struct { unsigned char *input_p; unsigned char *first_byte; unsigned char *last_byte; + bfd_size_type total_amt; bfd *abfd; } common_header_type ; |