diff options
| author | Nick Clifton <nickc@redhat.com> | 2014-11-21 21:44:04 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2014-11-21 21:44:04 +0000 |
| commit | 0a9d414aa114b7b7e609cbcbc285f79031bbe608 (patch) | |
| tree | bca8497bf5147c53a4fd786ecf96c44a83906418 /binutils/ChangeLog | |
| parent | 5974eba65b82912621ac68f2c0ff844efbd02b25 (diff) | |
| download | gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.zip gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.tar.gz gdb-0a9d414aa114b7b7e609cbcbc285f79031bbe608.tar.bz2 | |
Fixes for memory access violations exposed by fuzzinf various binaries.
PR binutils/17512
* dwarf.c (get_encoded_value): Check for an encoded size of 0.
(display_debug_lines_raw): Check for an invalid line range value.
(display_debug_frames): Check for corrupt augmentation data.
* coffgen.c (coff_get_normalized_symtab): Check for an excessive
number of auxillary entries.
* ieee.c (next_byte): Convert to a function. Return FALSE if the
next byte is beyond the end of the buffer.
(parse_int): Test the return value of next_byte.
(parse_expression): Convert to boolean. Return FALSE if the
parsing failed. Test the return value of next_byte.
(ieee_seek): Convert to a function. Return FALSE if the seek goes
beyond the end of the buffer.
(ieee_slurp_external_symbols): Test the return value of ieee_seek
and next_byte.
(ieee_slurp_sections): Convert to boolean. Return FALSE if the
operation failed. Test the return value of ieee_seek and
next_byte.
(ieee_archive_p): Test the return value of ieee_seek and
next_byte.
(do_one): Likewise.
(ieee_slurp_section_data): Likewise.
(ieee_object_p): Likewise. Store the size of the buffer in the
total_amt field in the header.
* libieee.h (common_header_type): Add amt field.
* mach-o.c (bfd_mach_o_canonicalize_one_reloc): Check that the
reloc's value is within range.
(bfd_mach_o_read_symtab_symbols): Nullify the symbols field if the
operation fails.
* pei-x86_64.c (pex64_xdata_print_uwd_codes): Replace abort with
an error message.
(pex64_dump_xdata): Check for buffer overflows.
* versados.c (process_otr): Check that the section exists before
taking its size.
(versados_object_p): Make sure that enough data was read for the
header to be checked.
* vms-alpha.c (vms_get_remaining_object_record): Change
read_so_far parameter to an unsigned int. Check that the amount
read is in range.
Diffstat (limited to 'binutils/ChangeLog')
| -rw-r--r-- | binutils/ChangeLog | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog index cc4590a..dbf07f9 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,5 +1,12 @@ 2014-11-21 Nick Clifton <nickc@redhat.com> + PR binutils/17512 + * dwarf.c (get_encoded_value): Check for an encoded size of 0. + (display_debug_lines_raw): Check for an invalid line range value. + (display_debug_frames): Check for corrupt augmentation data. + +2014-11-21 Nick Clifton <nickc@redhat.com> + PR binutils/17531 * readelf.c (process_version_sections): Prevent an infinite loop processing corrupt version need data. |