diff options
| author | Nick Clifton <nickc@redhat.com> | 2016-11-08 15:03:46 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2016-11-08 15:03:46 +0000 |
| commit | cb64e50d42a49bce61050c79c5ab0846905b6a82 (patch) | |
| tree | 8b9cd3d83f0cdf8c8fbe1de7840f8ff395abbe8e /binutils | |
| parent | 93f9a11fbdb8f09428b17180d51a09a1bda39a52 (diff) | |
| download | gdb-cb64e50d42a49bce61050c79c5ab0846905b6a82.zip gdb-cb64e50d42a49bce61050c79c5ab0846905b6a82.tar.gz gdb-cb64e50d42a49bce61050c79c5ab0846905b6a82.tar.bz2 | |
Fix heap-buffer-overflow error detected by address sanitization on a fuzzed binary.
PR binutils/20794
* readelf.c (process_section_headers): Fix off-by-one error when
checking for invalid sh_link and sh_info fields.
Diffstat (limited to 'binutils')
| -rw-r--r-- | binutils/ChangeLog | 6 | ||||
| -rw-r--r-- | binutils/readelf.c | 8 |
2 files changed, 10 insertions, 4 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog index 09f76b9..d586e03 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2016-11-08 Nick Clifton <nickc@redhat.com> + + PR binutils/20794 + * readelf.c (process_section_headers): Fix off-by-one error when + checking for invalid sh_link and sh_info fields. + 2016-11-04 Andrew Burgess <andrew.burgess@embecosm.com> * objcopy.c (copy_section): Add extra calls to free for error diff --git a/binutils/readelf.c b/binutils/readelf.c index 114486c..e782e95 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -5978,7 +5978,7 @@ process_section_headers (FILE * file) case SHT_REL: case SHT_RELA: if (section->sh_link < 1 - || section->sh_link > elf_header.e_shnum + || section->sh_link >= elf_header.e_shnum || (section_headers[section->sh_link].sh_type != SHT_SYMTAB && section_headers[section->sh_link].sh_type != SHT_DYNSYM)) warn (_("[%2u]: Link field (%u) should index a symtab section.\n"), @@ -5992,7 +5992,7 @@ process_section_headers (FILE * file) case SHT_GNU_verdef: case SHT_GNU_LIBLIST: if (section->sh_link < 1 - || section->sh_link > elf_header.e_shnum + || section->sh_link >= elf_header.e_shnum || section_headers[section->sh_link].sh_type != SHT_STRTAB) warn (_("[%2u]: Link field (%u) should index a string section.\n"), i, section->sh_link); @@ -6025,7 +6025,7 @@ process_section_headers (FILE * file) case SHT_REL: case SHT_RELA: if (section->sh_info < 1 - || section->sh_info > elf_header.e_shnum + || section->sh_info >= elf_header.e_shnum || (section_headers[section->sh_info].sh_type != SHT_PROGBITS && section_headers[section->sh_info].sh_type != SHT_NOBITS && section_headers[section->sh_info].sh_type != SHT_NOTE @@ -6072,7 +6072,7 @@ process_section_headers (FILE * file) ; else if (section->sh_flags & SHF_INFO_LINK) { - if (section->sh_info < 1 || section->sh_info > elf_header.e_shnum) + if (section->sh_info < 1 || section->sh_info >= elf_header.e_shnum) warn (_("[%2u]: Expected link to another section in info field"), i); } else if (section->sh_type < SHT_LOOS && section->sh_info != 0) |