mirror of
https://git.yoctoproject.org/poky
synced 2026-04-21 03:32:12 +02:00
binutils: CVE-2017-15938
Source: binutils-gdb.git
MR: 76766
Type: Security Fix
Disposition: Backport from binutils master
ChangeID: f080669b4e6f7c9088e30858238da5f4315192f3
Description:
PR22209, invalid memory read in find_abstract_instance_name
This patch adds bounds checking for DW_FORM_ref_addr die refs, and
calculates them relative to the first .debug_info section. See the
big comment for why calculating relative to the current .debug_info
section was wrong for relocatable object files.
PR 22209
* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
to stash->info_ptr_memory, and check die_ref is within that memory.
Set info_ptr_end correctly when another CU is refd. Check die_ref
for DW_FORM_ref4 etc. is within CU.
Affects: <= 2.29
(From OE-Core rev: 592f315516e602bd9a9bdc3d116771528cd433d1)
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Thiruvadi Rajaraman
committed by
Richard Purdie
Richard Purdie
parent
7006ecaba3
commit
9c53a526d0
@@ -102,6 +102,7 @@ SRC_URI = "\
|
||||
file://CVE-2017-9955_9.patch \
|
||||
file://CVE-2017-14729.patch \
|
||||
file://CVE-2017-15024.patch \
|
||||
file://CVE-2017-15938.patch \
|
||||
"
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
|
||||
153
meta/recipes-devtools/binutils/binutils/CVE-2017-15938.patch
Normal file
153
meta/recipes-devtools/binutils/binutils/CVE-2017-15938.patch
Normal file
@@ -0,0 +1,153 @@
|
||||
commit 1b86808a86077722ee4f42ff97f836b12420bb2a
|
||||
Author: Alan Modra <amodra@gmail.com>
|
||||
Date: Tue Sep 26 21:47:24 2017 +0930
|
||||
|
||||
PR22209, invalid memory read in find_abstract_instance_name
|
||||
|
||||
This patch adds bounds checking for DW_FORM_ref_addr die refs, and
|
||||
calculates them relative to the first .debug_info section. See the
|
||||
big comment for why calculating relative to the current .debug_info
|
||||
section was wrong for relocatable object files.
|
||||
|
||||
PR 22209
|
||||
* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
|
||||
(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
|
||||
to stash->info_ptr_memory, and check die_ref is within that memory.
|
||||
Set info_ptr_end correctly when another CU is refd. Check die_ref
|
||||
for DW_FORM_ref4 etc. is within CU.
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
CVE: CVE-2017-15938
|
||||
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
||||
|
||||
Index: git/bfd/dwarf2.c
|
||||
===================================================================
|
||||
--- git.orig/bfd/dwarf2.c 2017-11-07 18:52:19.896253364 +0530
|
||||
+++ git/bfd/dwarf2.c 2017-11-07 18:52:19.952253802 +0530
|
||||
@@ -119,8 +119,7 @@
|
||||
|
||||
/* A pointer to the memory block allocated for info_ptr. Neither
|
||||
info_ptr nor sec_info_ptr are guaranteed to stay pointing to the
|
||||
- beginning of the malloc block. This is used only to free the
|
||||
- memory later. */
|
||||
+ beginning of the malloc block. */
|
||||
bfd_byte *info_ptr_memory;
|
||||
|
||||
/* Pointer to the symbol table. */
|
||||
@@ -238,9 +237,6 @@
|
||||
by its reference. */
|
||||
bfd_byte *info_ptr_unit;
|
||||
|
||||
- /* Pointer to the start of the debug section, for DW_FORM_ref_addr. */
|
||||
- bfd_byte *sec_info_ptr;
|
||||
-
|
||||
/* The offset into .debug_line of the line number table. */
|
||||
unsigned long line_offset;
|
||||
|
||||
@@ -2294,21 +2290,37 @@
|
||||
if (attr_ptr->form == DW_FORM_ref_addr)
|
||||
{
|
||||
/* We only support DW_FORM_ref_addr within the same file, so
|
||||
- any relocations should be resolved already. */
|
||||
- if (!die_ref)
|
||||
+ any relocations should be resolved already. Check this by
|
||||
+ testing for a zero die_ref; There can't be a valid reference
|
||||
+ to the header of a .debug_info section.
|
||||
+ DW_FORM_ref_addr is an offset relative to .debug_info.
|
||||
+ Normally when using the GNU linker this is accomplished by
|
||||
+ emitting a symbolic reference to a label, because .debug_info
|
||||
+ sections are linked at zero. When there are multiple section
|
||||
+ groups containing .debug_info, as there might be in a
|
||||
+ relocatable object file, it would be reasonable to assume that
|
||||
+ a symbolic reference to a label in any .debug_info section
|
||||
+ might be used. Since we lay out multiple .debug_info
|
||||
+ sections at non-zero VMAs (see place_sections), and read
|
||||
+ them contiguously into stash->info_ptr_memory, that means
|
||||
+ the reference is relative to stash->info_ptr_memory. */
|
||||
+ size_t total;
|
||||
+
|
||||
+ info_ptr = unit->stash->info_ptr_memory;
|
||||
+ info_ptr_end = unit->stash->info_ptr_end;
|
||||
+ total = info_ptr_end - info_ptr;
|
||||
+ if (!die_ref || die_ref >= total)
|
||||
{
|
||||
_bfd_error_handler
|
||||
- (_("Dwarf Error: Abstract instance DIE ref zero."));
|
||||
+ (_("Dwarf Error: Invalid abstract instance DIE ref."));
|
||||
bfd_set_error (bfd_error_bad_value);
|
||||
return FALSE;
|
||||
}
|
||||
-
|
||||
- info_ptr = unit->sec_info_ptr + die_ref;
|
||||
- info_ptr_end = unit->end_ptr;
|
||||
+ info_ptr += die_ref;
|
||||
|
||||
/* Now find the CU containing this pointer. */
|
||||
if (info_ptr >= unit->info_ptr_unit && info_ptr < unit->end_ptr)
|
||||
- ;
|
||||
+ info_ptr_end = unit->end_ptr;
|
||||
else
|
||||
{
|
||||
/* Check other CUs to see if they contain the abbrev. */
|
||||
@@ -2324,7 +2336,10 @@
|
||||
break;
|
||||
|
||||
if (u)
|
||||
- unit = u;
|
||||
+ {
|
||||
+ unit = u;
|
||||
+ info_ptr_end = unit->end_ptr;
|
||||
+ }
|
||||
/* else FIXME: What do we do now ? */
|
||||
}
|
||||
}
|
||||
@@ -2346,8 +2361,22 @@
|
||||
}
|
||||
else
|
||||
{
|
||||
- info_ptr = unit->info_ptr_unit + die_ref;
|
||||
+ /* DW_FORM_ref1, DW_FORM_ref2, DW_FORM_ref4, DW_FORM_ref8 or
|
||||
+ DW_FORM_ref_udata. These are all references relative to the
|
||||
+ start of the current CU. */
|
||||
+ size_t total;
|
||||
+
|
||||
+ info_ptr = unit->info_ptr_unit;
|
||||
info_ptr_end = unit->end_ptr;
|
||||
+ total = info_ptr_end - info_ptr;
|
||||
+ if (!die_ref || die_ref >= total)
|
||||
+ {
|
||||
+ _bfd_error_handler
|
||||
+ (_("Dwarf Error: Invalid abstract instance DIE ref."));
|
||||
+ bfd_set_error (bfd_error_bad_value);
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+ info_ptr += die_ref;
|
||||
}
|
||||
|
||||
abbrev_number = safe_read_leb128 (abfd, info_ptr, &bytes_read, FALSE, info_ptr_end);
|
||||
@@ -2846,7 +2875,6 @@
|
||||
unit->end_ptr = end_ptr;
|
||||
unit->stash = stash;
|
||||
unit->info_ptr_unit = info_ptr_unit;
|
||||
- unit->sec_info_ptr = stash->sec_info_ptr;
|
||||
|
||||
for (i = 0; i < abbrev->num_attrs; ++i)
|
||||
{
|
||||
Index: git/bfd/ChangeLog
|
||||
===================================================================
|
||||
--- git.orig/bfd/ChangeLog 2017-11-07 18:52:19.900253395 +0530
|
||||
+++ git/bfd/ChangeLog 2017-11-07 18:53:29.668799630 +0530
|
||||
@@ -1,3 +1,12 @@
|
||||
+2017-09-26 Alan Modra <amodra@gmail.com>
|
||||
+
|
||||
+ PR 22209
|
||||
+ * dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
|
||||
+ (find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
|
||||
+ to stash->info_ptr_memory, and check die_ref is within that memory.
|
||||
+ Set info_ptr_end correctly when another CU is refd. Check die_ref
|
||||
+ for DW_FORM_ref4 etc. is within CU.
|
||||
+
|
||||
2017-09-24 Alan Modra <amodra@gmail.com>
|
||||
|
||||
PR 22187
|
||||
Reference in New Issue
Block a user