blob: fe1f9a100daa6edb3007b5da06ddd249ad4d4c17 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
commit 04f963fd489cae724a60140e13984415c205f4ac
Author: Nick Clifton <nickc@redhat.com>
Date: Wed Jun 14 10:35:16 2017 +0100
Fix seg-faults in objdump when disassembling a corrupt versados binary.
PR binutils/21591
* versados.c (versados_mkobject): Zero the allocated tdata structure.
(process_otr): Check for an invalid offset in the otr structure.
Upstream-Status: Backport
CVE: CVE-2017-9753 and CVE-2017-9754
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Index: git/bfd/versados.c
===================================================================
--- git.orig/bfd/versados.c 2017-09-21 15:08:34.445197987 +0530
+++ git/bfd/versados.c 2017-09-21 15:08:34.429197878 +0530
@@ -149,7 +149,7 @@
if (abfd->tdata.versados_data == NULL)
{
bfd_size_type amt = sizeof (tdata_type);
- tdata_type *tdata = bfd_alloc (abfd, amt);
+ tdata_type *tdata = bfd_zalloc (abfd, amt);
if (tdata == NULL)
return FALSE;
@@ -344,13 +344,13 @@
};
static int
-get_offset (int len, unsigned char *ptr)
+get_offset (unsigned int len, unsigned char *ptr)
{
int val = 0;
if (len)
{
- int i;
+ unsigned int i;
val = *ptr++;
if (val & 0x80)
@@ -393,9 +393,13 @@
int flag = *srcp++;
int esdids = (flag >> 5) & 0x7;
int sizeinwords = ((flag >> 3) & 1) ? 2 : 1;
- int offsetlen = flag & 0x7;
+ unsigned int offsetlen = flag & 0x7;
int j;
+ /* PR 21591: Check for invalid lengths. */
+ if (srcp + esdids + offsetlen >= endp)
+ return;
+
if (esdids == 0)
{
/* A zero esdid means the new pc is the offset given. */
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog 2017-09-21 15:08:34.445197987 +0530
+++ git/bfd/ChangeLog 2017-09-21 15:08:34.429197878 +0530
@@ -90,6 +90,12 @@
(_bfd_vms_slurp_etir): Add checks for attempts to read beyond the
end of etir record.
+2017-06-14 Nick Clifton <nickc@redhat.com>
+
+ PR binutils/21591
+ * versados.c (versados_mkobject): Zero the allocated tdata structure.
+ (process_otr): Check for an invalid offset in the otr structure.
+
2017-04-29 Alan Modra <amodra@gmail.com>
PR 21432
|
