diff options
| author | Nick Clifton <nickc@redhat.com> | 2015-01-22 12:06:04 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2015-01-22 12:06:04 +0000 |
| commit | 4e5cb37e7f3403d5398a323566ff9c995f0c9a81 (patch) | |
| tree | 6c1f448ab158160c868ef83e3e3251a90b5b39ef /bfd/vms-alpha.c | |
| parent | b01a4b043a5b08e1208b1fedd61a6f3d65a328e0 (diff) | |
| download | gdb-4e5cb37e7f3403d5398a323566ff9c995f0c9a81.zip gdb-4e5cb37e7f3403d5398a323566ff9c995f0c9a81.tar.gz gdb-4e5cb37e7f3403d5398a323566ff9c995f0c9a81.tar.bz2 | |
Fixes memory access violations triggered by running dlltool on fuzzed binaries.
PR binutils/17512
* coffcode.h (handle_COMDAT): When searching for the section
symbol, make sure that there is space left in the symbol table.
* vms-alpha.c (_bfd_vms_slurp_ehdr): Add range checks.
Diffstat (limited to 'bfd/vms-alpha.c')
| -rw-r--r-- | bfd/vms-alpha.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c index faddf7c..9576607 100644 --- a/bfd/vms-alpha.c +++ b/bfd/vms-alpha.c @@ -859,9 +859,12 @@ _bfd_vms_slurp_ehdr (bfd *abfd) { unsigned char *ptr; unsigned char *vms_rec; + unsigned char *end; int subtype; vms_rec = PRIV (recrd.rec); + /* PR 17512: file: 62736583. */ + end = PRIV (recrd.buf) + PRIV (recrd.buf_size); vms_debug2 ((2, "HDR/EMH\n")); @@ -873,28 +876,42 @@ _bfd_vms_slurp_ehdr (bfd *abfd) { case EMH__C_MHD: /* Module header. */ + if (vms_rec + 21 >= end) + goto fail; PRIV (hdr_data).hdr_b_strlvl = vms_rec[6]; PRIV (hdr_data).hdr_l_arch1 = bfd_getl32 (vms_rec + 8); PRIV (hdr_data).hdr_l_arch2 = bfd_getl32 (vms_rec + 12); PRIV (hdr_data).hdr_l_recsiz = bfd_getl32 (vms_rec + 16); + if ((vms_rec + 20 + vms_rec[20] + 1) >= end) + goto fail; PRIV (hdr_data).hdr_t_name = _bfd_vms_save_counted_string (vms_rec + 20); ptr = vms_rec + 20 + vms_rec[20] + 1; + if ((ptr + *ptr + 1) >= end) + goto fail; PRIV (hdr_data).hdr_t_version =_bfd_vms_save_counted_string (ptr); ptr += *ptr + 1; + if (ptr + 17 >= end) + goto fail; PRIV (hdr_data).hdr_t_date = _bfd_vms_save_sized_string (ptr, 17); break; case EMH__C_LNM: + if (vms_rec + PRIV (recrd.rec_size - 6) > end) + goto fail; PRIV (hdr_data).hdr_c_lnm = _bfd_vms_save_sized_string (vms_rec, PRIV (recrd.rec_size - 6)); break; case EMH__C_SRC: + if (vms_rec + PRIV (recrd.rec_size - 6) > end) + goto fail; PRIV (hdr_data).hdr_c_src = _bfd_vms_save_sized_string (vms_rec, PRIV (recrd.rec_size - 6)); break; case EMH__C_TTL: + if (vms_rec + PRIV (recrd.rec_size - 6) > end) + goto fail; PRIV (hdr_data).hdr_c_ttl = _bfd_vms_save_sized_string (vms_rec, PRIV (recrd.rec_size - 6)); break; @@ -905,6 +922,7 @@ _bfd_vms_slurp_ehdr (bfd *abfd) break; default: + fail: bfd_set_error (bfd_error_wrong_format); return FALSE; } |