diff options
| author | Sergei Trofimovich <slyfox@gentoo.org> | 2017-06-24 18:40:41 +0100 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2017-06-25 10:29:57 +0930 |
| commit | 5cc4ca837deac7dc962d8a3741aa120c50ab41da (patch) | |
| tree | 999fbc5454d04072b52522b07be73b64d69b041d /bfd | |
| parent | b21351faa29dfa6deab3afcb5a2ee78548239274 (diff) | |
| download | gdb-5cc4ca837deac7dc962d8a3741aa120c50ab41da.zip gdb-5cc4ca837deac7dc962d8a3741aa120c50ab41da.tar.gz gdb-5cc4ca837deac7dc962d8a3741aa120c50ab41da.tar.bz2 | |
fix out-of-bounds access in elf.c:find_link
The out-of-bounds access is reproducible on 'ia64-strip' command
(see sample from https://bugs.gentoo.org/show_bug.cgi?id=622500)
The output file contains less section than original one.
This tricks 'hint' access to go out-of-bounds:
* elf.c (find_link): Bounds check "hint".
Diffstat (limited to 'bfd')
| -rw-r--r-- | bfd/ChangeLog | 4 | ||||
| -rw-r--r-- | bfd/elf.c | 6 |
2 files changed, 8 insertions, 2 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index f7ef5e1..945cb68 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,7 @@ +2017-06-25 Sergei Trofimovich <slyfox@gentoo.org> + + * elf.c (find_link): Bounds check "hint". + 2017-06-24 Thomas Preud'homme <thomas.preudhomme@arm.com> * elf32-arm.c (using_thumb_only): Update list of architectures in @@ -1283,7 +1283,8 @@ section_match (const Elf_Internal_Shdr * a, to be the correct section. */ static unsigned int -find_link (const bfd * obfd, const Elf_Internal_Shdr * iheader, const unsigned int hint) +find_link (const bfd *obfd, const Elf_Internal_Shdr *iheader, + const unsigned int hint) { Elf_Internal_Shdr ** oheaders = elf_elfsections (obfd); unsigned int i; @@ -1291,7 +1292,8 @@ find_link (const bfd * obfd, const Elf_Internal_Shdr * iheader, const unsigned i BFD_ASSERT (iheader != NULL); /* See PR 20922 for a reproducer of the NULL test. */ - if (oheaders[hint] != NULL + if (hint < elf_numsections (obfd) + && oheaders[hint] != NULL && section_match (oheaders[hint], iheader)) return hint; |