1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
From 04f963fd489cae724a60140e13984415c205f4ac Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Wed, 14 Jun 2017 10:35:16 +0100
Subject: [PATCH] Fix seg-faults in objdump when disassembling a corrupt
versados binary.
PR binutils/21591
* versados.c (versados_mkobject): Zero the allocated tdata structure.
(process_otr): Check for an invalid offset in the otr structure.
Upstream-Status: Backport
CVE: CVE-2017-9753
CVE: CVE-2017-9754
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 6 ++++++
bfd/versados.c | 12 ++++++++----
2 files changed, 14 insertions(+), 4 deletions(-)
Index: git/bfd/versados.c
===================================================================
--- git.orig/bfd/versados.c
+++ git/bfd/versados.c
@@ -149,7 +149,7 @@ versados_mkobject (bfd *abfd)
if (abfd->tdata.versados_data == NULL)
{
bfd_size_type amt = sizeof (tdata_type);
- tdata_type *tdata = bfd_alloc (abfd, amt);
+ tdata_type *tdata = bfd_zalloc (abfd, amt);
if (tdata == NULL)
return FALSE;
@@ -345,13 +345,13 @@ reloc_howto_type versados_howto_table[]
};
static int
-get_offset (int len, unsigned char *ptr)
+get_offset (unsigned int len, unsigned char *ptr)
{
int val = 0;
if (len)
{
- int i;
+ unsigned int i;
val = *ptr++;
if (val & 0x80)
@@ -394,9 +394,13 @@ process_otr (bfd *abfd, struct ext_otr *
int flag = *srcp++;
int esdids = (flag >> 5) & 0x7;
int sizeinwords = ((flag >> 3) & 1) ? 2 : 1;
- int offsetlen = flag & 0x7;
+ unsigned int offsetlen = flag & 0x7;
int j;
+ /* PR 21591: Check for invalid lengths. */
+ if (srcp + esdids + offsetlen >= endp)
+ return;
+
if (esdids == 0)
{
/* A zero esdid means the new pc is the offset given. */
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -8,6 +8,10 @@
(ieee_archive_p): Likewise.
2017-06-14 Nick Clifton <nickc@redhat.com>
+
+ PR binutils/21591
+ * versados.c (versados_mkobject): Zero the allocated tdata structure.
+ (process_otr): Check for an invalid offset in the otr structure.
PR binutils/21589
* vms-alpha.c (_bfd_vms_get_value): Add an extra parameter - the
|