From 30838132997e6a3cfe3ec11c58b32b22f6f6b102 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 20 Sep 2018 15:29:17 +0930 Subject: [PATCH] Bug 23686, two segment faults in nm Fixes the bugs exposed by the testcases in the PR, plus two more bugs I noticed when looking at _bfd_stab_section_find_nearest_line. PR 23686 * dwarf2.c (read_section): Error when attempting to malloc "(bfd_size_type) -1". * syms.c (_bfd_stab_section_find_nearest_line): Bounds check function_name. Bounds check reloc address. Formatting. Ensure .stabstr zero terminated. CVE: CVE-2018-17358 and CVE-2018-17359 Upstream-Status: Backport Signed-off-by: Zhixiong Chi --- bfd/ChangeLog | 9 +++++++++ bfd/dwarf2.c | 9 ++++++++- bfd/syms.c | 22 ++++++++++++++++------ 3 files changed, 33 insertions(+), 7 deletions(-) --- a/bfd/dwarf2.c +++ b/bfd/dwarf2.c @@ -527,6 +527,7 @@ read_section (bfd * abfd, asection *msec; const char *section_name = sec->uncompressed_name; bfd_byte *contents = *section_buffer; + bfd_size_type amt; /* The section may have already been read. */ if (contents == NULL) @@ -549,7 +550,13 @@ read_section (bfd * abfd, *section_size = msec->rawsize ? msec->rawsize : msec->size; /* Paranoia - alloc one extra so that we can make sure a string section is NUL terminated. */ - contents = (bfd_byte *) bfd_malloc (*section_size + 1); + amt = *section_size + 1; + if (amt == 0) + { + bfd_set_error (bfd_error_no_memory); + return FALSE; + } + contents = (bfd_byte *) bfd_malloc (amt); if (contents == NULL) return FALSE; if (syms --- a/bfd/syms.c +++ b/bfd/syms.c @@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd 0, strsize)) return FALSE; + /* Stab strings ought to be nul terminated. Ensure the last one + is, to prevent running off the end of the buffer. */ + info->strs[strsize - 1] = 0; + /* If this is a relocatable object file, we have to relocate the entries in .stab. This should always be simple 32 bit relocations against symbols defined in this object file, so @@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd || r->howto->bitsize != 32 || r->howto->pc_relative || r->howto->bitpos != 0 - || r->howto->dst_mask != 0xffffffff) + || r->howto->dst_mask != 0xffffffff + || r->address * bfd_octets_per_byte (abfd) + 4 > stabsize) { _bfd_error_handler (_("unsupported .stab relocation")); @@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd { nul_fun = stab; nul_str = str; - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize && *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO) @@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd directory_name = file_name; file_name = ((char *) str + bfd_get_32 (abfd, stab + STRDXOFF)); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; } } @@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); /* PR 17512: file: 0c680a1f. */ /* PR 17512: file: 5da8aec4. */ - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; break; @@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); if (function_name == (char *) str) continue; - if (function_name >= (char *) info->strs + strsize) + if (function_name >= (char *) info->strs + strsize + || function_name < (char *) str) function_name = NULL; nul_fun = NULL; @@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd if (val <= offset) { file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; *pline = 0; }