diff options
| author |   Alan Modra <amodra@gmail.com> | 2020-09-04 19:19:18 +0930 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2021-02-07 02:10:05 +0200 |
| commit | 68d5bbdfaecac542895100ac9f93e49e7a4cf551 (patch) | |
| tree | f25d09052e9d6e7d56832fffd9ea73eacd39ec7b | |
| parent | ld: Override the IR definition for non-ELF targets (diff) | |
| download | binutils-gdb-gentoo/binutils-2.35.2.tar.gz binutils-gdb-gentoo/binutils-2.35.2.tar.bz2 binutils-gdb-gentoo/binutils-2.35.2.zip | |
PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_sectiongentoo/binutils-2.35.2-1gentoo/binutils-2.35.2
A horribly fuzzed object with section headers inside the ELF header.
Disallow that, and crazy reloc sizes.
PR 26574
* elfcode.h (elf_object_p): Sanity check section header offset.
* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
sh_entsize.
(cherry picked from commit 8642dafaef21aa6747cec01df1977e9c52eb4679)
| -rw-r--r-- | bfd/ChangeLog | 7 | ||||
| -rw-r--r-- | bfd/elf.c | 4 | ||||
| -rw-r--r-- | bfd/elfcode.h | 8 |
3 files changed, 14 insertions, 5 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 13d36704607..70805d71e6b 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -53,6 +53,13 @@ * dwarf2.c (read_rnglists): Advance rngs_ptr after _bfd_safe_read_leb128 when parsing DW_RLE_offset_pair. +2020-09-04 Alan Modra <amodra@gmail.com> + + PR 26574 + * elfcode.h (elf_object_p): Sanity check section header offset. + * elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check + sh_entsize. + 2021-01-01 Alan Modra <amodra@gmail.com> Apply from master diff --git a/bfd/elf.c b/bfd/elf.c index fe375e7346e..9f291663992 100644 --- a/bfd/elf.c +++ b/bfd/elf.c @@ -12527,7 +12527,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd * abfd, Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr; if (hdr->sh_type == SHT_SECONDARY_RELOC - && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx) + && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx + && (hdr->sh_entsize == ebd->s->sizeof_rel + || hdr->sh_entsize == ebd->s->sizeof_rela)) { bfd_byte * native_relocs; bfd_byte * native_reloc; diff --git a/bfd/elfcode.h b/bfd/elfcode.h index f4a7829f270..54ef8906379 100644 --- a/bfd/elfcode.h +++ b/bfd/elfcode.h @@ -568,7 +568,7 @@ elf_object_p (bfd *abfd) /* If this is a relocatable file and there is no section header table, then we're hosed. */ - if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL) + if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL) goto got_wrong_format_error; /* As a simple sanity check, verify that what BFD thinks is the @@ -578,7 +578,7 @@ elf_object_p (bfd *abfd) goto got_wrong_format_error; /* Further sanity check. */ - if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0) + if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0) goto got_wrong_format_error; ebd = get_elf_backend_data (abfd); @@ -615,7 +615,7 @@ elf_object_p (bfd *abfd) && ebd->elf_osabi != ELFOSABI_NONE) goto got_wrong_format_error; - if (i_ehdrp->e_shoff != 0) + if (i_ehdrp->e_shoff >= sizeof (x_ehdr)) { file_ptr where = (file_ptr) i_ehdrp->e_shoff; @@ -807,7 +807,7 @@ elf_object_p (bfd *abfd) } } - if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0) + if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr)) { unsigned int num_sec; |