aboutsummaryrefslogtreecommitdiff
path: root/bfd/peXXigen.c
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2014-11-18 14:40:05 +0000
committerNick Clifton <nickc@redhat.com>2014-11-18 14:40:05 +0000
commit6937bb54a9c3ddc7ba330bc18af76f8dbe856ac3 (patch)
treeef3620d4de908919f540cbb095a7f9f62da9d72c /bfd/peXXigen.c
parentde84aee38c50fd306876cdbf92007afaacbfab4d (diff)
downloadgdb-6937bb54a9c3ddc7ba330bc18af76f8dbe856ac3.zip
gdb-6937bb54a9c3ddc7ba330bc18af76f8dbe856ac3.tar.gz
gdb-6937bb54a9c3ddc7ba330bc18af76f8dbe856ac3.tar.bz2
More fixes for illegal memory accesses exposed by fuzzed binaries.
PR binutils/17512 * peXXIgen.c (pe_print_pdata): Fail if the section's virtual size is larger than its real size. (rsrc_print_section): Fix off-by-one error checking for overflow. * pei-x86_64.c (pex64_bfd_print_pdata): Handle empty unwind sections. * dwarf.c (get_encoded_value): Warn and return if the encoded value is more than 64-bits long. (SAFE_BYTE_GET): Do not attempt to read more than 64-bits. (process_extended_line_op): Add more range checks. (decode_location_expression): Use the return value from display_block. Add more range checks. (read_debug_line_header): Add range check. (display_debug_lines_raw): Add range checks. (display_debug_frames): Silently skip multiple zero terminators. Add range checks. (process_cu_tu_index): Check for non-existant or empty sections. Use SAFE_BYTE_GET instead of byte_get.
Diffstat (limited to 'bfd/peXXigen.c')
-rw-r--r--bfd/peXXigen.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index 13e39e4..b163a1e 100644
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -1890,6 +1890,14 @@ pe_print_pdata (bfd * abfd, void * vfile)
if (datasize == 0)
return TRUE;
+ /* PR 17512: file: 002-193900-0.004. */
+ if (datasize < stop)
+ {
+ fprintf (file, _("Virtual size of .pdata section (%ld) larger than real size (%ld)\n"),
+ (long) stop, (long) datasize);
+ return FALSE;
+ }
+
if (! bfd_malloc_and_get_section (abfd, section, &data))
{
if (data != NULL)
@@ -2526,7 +2534,7 @@ rsrc_print_section (bfd * abfd, void * vfile)
/* If the extra data is all zeros then do not complain.
This is just padding so that the section meets the
page size requirements. */
- while (data ++ < regions.section_end)
+ while (++ data < regions.section_end)
if (*data != 0)
break;
if (data < regions.section_end)