From 063bb0250defafcc55544474a2961ecbc153882e Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Thu, 8 Jan 2015 15:39:49 +0000 Subject: Fix memory access violations exposed by running strip on fuzzed binaries. PR binutils/17512 * coffcode.h (coff_slurp_symbol_table): Return false if we failed to load the line table. * elf.c (_bfd_elf_map_sections_to_segments): Enforce a minimum maxpagesize of 1. * peXXigen.c (_bfd_XX_bfd_copy_private_bfd_data_common): Fail if the Data Directory Size is too large. * objcopy.c (copy_object): Free the symbol table if no symbols could be loaded. (copy_file): Use bfd_close_all_done to close files that could not be copied. --- binutils/objcopy.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'binutils/objcopy.c') diff --git a/binutils/objcopy.c b/binutils/objcopy.c index 25f0131..9524bb8 100644 --- a/binutils/objcopy.c +++ b/binutils/objcopy.c @@ -1776,6 +1776,14 @@ copy_object (bfd *ibfd, bfd *obfd, const bfd_arch_info_type *input_arch) bfd_nonfatal_message (NULL, ibfd, NULL, NULL); return FALSE; } + /* PR 17512: file: d6323821 + If the symbol table could not be loaded do not pretend that we have + any symbols. This trips us up later on when we load the relocs. */ + if (symcount == 0) + { + free (isympp); + osympp = isympp = NULL; + } /* BFD mandates that all output sections be created and sizes set before any output is done. Thus, we traverse all sections multiple times. */ @@ -2552,7 +2560,11 @@ copy_file (const char *input_filename, const char *output_filename, if (! copy_object (ibfd, obfd, input_arch)) status = 1; - if (!bfd_close (obfd)) + /* PR 17512: file: 0f15796a. + If the file could not be copied it may not be in a writeable + state. So use bfd_close_all_done to avoid the possibility of + writing uninitialised data into the file. */ + if (! (status ? bfd_close_all_done (obfd) : bfd_close (obfd))) { status = 1; bfd_nonfatal_message (output_filename, NULL, NULL, NULL); -- cgit v1.1