From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Sat, 27 Jan 2018 08:19:33 +1030 Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object PR 22741 * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in range before converting to a symbol table pointer. Upstream-Status: Backport Affects: <= 2.30 CVE: CVE-2018-7208 Signed-off-by: Armin Kuster --- bfd/ChangeLog | 6 ++++++ bfd/coffgen.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) Index: git/bfd/coffgen.c =================================================================== --- git.orig/bfd/coffgen.c +++ git/bfd/coffgen.c @@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd, } /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can generate one, so we must be careful to ignore it. */ - if (auxent->u.auxent.x_sym.x_tagndx.l > 0) + if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l + < obj_raw_syment_count (abfd)) { auxent->u.auxent.x_sym.x_tagndx.p = table_base + auxent->u.auxent.x_sym.x_tagndx.l; Index: git/bfd/ChangeLog =================================================================== --- git.orig/bfd/ChangeLog +++ git/bfd/ChangeLog @@ -1,3 +1,9 @@ +2018-01-29 Alan Modra + + PR 22741 + * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in + range before converting to a symbol table pointer. + 2018-02-06 Nick Clifton PR 22794