mirror of
https://git.yoctoproject.org/poky
synced 2026-09-15 06:49:33 +02:00
binutils: CVE-2017-15938
Source: binutils-gdb.git
MR: 76766
Type: Security Fix
Disposition: Backport from binutils master
ChangeID: f080669b4e6f7c9088e30858238da5f4315192f3
Description:
PR22209, invalid memory read in find_abstract_instance_name
This patch adds bounds checking for DW_FORM_ref_addr die refs, and
calculates them relative to the first .debug_info section. See the
big comment for why calculating relative to the current .debug_info
section was wrong for relocatable object files.
PR 22209
* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
to stash->info_ptr_memory, and check die_ref is within that memory.
Set info_ptr_end correctly when another CU is refd. Check die_ref
for DW_FORM_ref4 etc. is within CU.
Affects: <= 2.29
(From OE-Core rev: 592f315516e602bd9a9bdc3d116771528cd433d1)
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Thiruvadi Rajaraman
committed by
Richard Purdie
Richard Purdie
parent
7006ecaba3
commit
9c53a526d0
@@ -102,6 +102,7 @@ SRC_URI = "\
|
|||||||
file://CVE-2017-9955_9.patch \
|
file://CVE-2017-9955_9.patch \
|
||||||
file://CVE-2017-14729.patch \
|
file://CVE-2017-14729.patch \
|
||||||
file://CVE-2017-15024.patch \
|
file://CVE-2017-15024.patch \
|
||||||
|
file://CVE-2017-15938.patch \
|
||||||
"
|
"
|
||||||
S = "${WORKDIR}/git"
|
S = "${WORKDIR}/git"
|
||||||
|
|
||||||
|
|||||||
153
meta/recipes-devtools/binutils/binutils/CVE-2017-15938.patch
Normal file
153
meta/recipes-devtools/binutils/binutils/CVE-2017-15938.patch
Normal file
@@ -0,0 +1,153 @@
|
|||||||
|
commit 1b86808a86077722ee4f42ff97f836b12420bb2a
|
||||||
|
Author: Alan Modra <amodra@gmail.com>
|
||||||
|
Date: Tue Sep 26 21:47:24 2017 +0930
|
||||||
|
|
||||||
|
PR22209, invalid memory read in find_abstract_instance_name
|
||||||
|
|
||||||
|
This patch adds bounds checking for DW_FORM_ref_addr die refs, and
|
||||||
|
calculates them relative to the first .debug_info section. See the
|
||||||
|
big comment for why calculating relative to the current .debug_info
|
||||||
|
section was wrong for relocatable object files.
|
||||||
|
|
||||||
|
PR 22209
|
||||||
|
* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
|
||||||
|
(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
|
||||||
|
to stash->info_ptr_memory, and check die_ref is within that memory.
|
||||||
|
Set info_ptr_end correctly when another CU is refd. Check die_ref
|
||||||
|
for DW_FORM_ref4 etc. is within CU.
|
||||||
|
|
||||||
|
Upstream-Status: Backport
|
||||||
|
|
||||||
|
CVE: CVE-2017-15938
|
||||||
|
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
||||||
|
|
||||||
|
Index: git/bfd/dwarf2.c
|
||||||
|
===================================================================
|
||||||
|
--- git.orig/bfd/dwarf2.c 2017-11-07 18:52:19.896253364 +0530
|
||||||
|
+++ git/bfd/dwarf2.c 2017-11-07 18:52:19.952253802 +0530
|
||||||
|
@@ -119,8 +119,7 @@
|
||||||
|
|
||||||
|
/* A pointer to the memory block allocated for info_ptr. Neither
|
||||||
|
info_ptr nor sec_info_ptr are guaranteed to stay pointing to the
|
||||||
|
- beginning of the malloc block. This is used only to free the
|
||||||
|
- memory later. */
|
||||||
|
+ beginning of the malloc block. */
|
||||||
|
bfd_byte *info_ptr_memory;
|
||||||
|
|
||||||
|
/* Pointer to the symbol table. */
|
||||||
|
@@ -238,9 +237,6 @@
|
||||||
|
by its reference. */
|
||||||
|
bfd_byte *info_ptr_unit;
|
||||||
|
|
||||||
|
- /* Pointer to the start of the debug section, for DW_FORM_ref_addr. */
|
||||||
|
- bfd_byte *sec_info_ptr;
|
||||||
|
-
|
||||||
|
/* The offset into .debug_line of the line number table. */
|
||||||
|
unsigned long line_offset;
|
||||||
|
|
||||||
|
@@ -2294,21 +2290,37 @@
|
||||||
|
if (attr_ptr->form == DW_FORM_ref_addr)
|
||||||
|
{
|
||||||
|
/* We only support DW_FORM_ref_addr within the same file, so
|
||||||
|
- any relocations should be resolved already. */
|
||||||
|
- if (!die_ref)
|
||||||
|
+ any relocations should be resolved already. Check this by
|
||||||
|
+ testing for a zero die_ref; There can't be a valid reference
|
||||||
|
+ to the header of a .debug_info section.
|
||||||
|
+ DW_FORM_ref_addr is an offset relative to .debug_info.
|
||||||
|
+ Normally when using the GNU linker this is accomplished by
|
||||||
|
+ emitting a symbolic reference to a label, because .debug_info
|
||||||
|
+ sections are linked at zero. When there are multiple section
|
||||||
|
+ groups containing .debug_info, as there might be in a
|
||||||
|
+ relocatable object file, it would be reasonable to assume that
|
||||||
|
+ a symbolic reference to a label in any .debug_info section
|
||||||
|
+ might be used. Since we lay out multiple .debug_info
|
||||||
|
+ sections at non-zero VMAs (see place_sections), and read
|
||||||
|
+ them contiguously into stash->info_ptr_memory, that means
|
||||||
|
+ the reference is relative to stash->info_ptr_memory. */
|
||||||
|
+ size_t total;
|
||||||
|
+
|
||||||
|
+ info_ptr = unit->stash->info_ptr_memory;
|
||||||
|
+ info_ptr_end = unit->stash->info_ptr_end;
|
||||||
|
+ total = info_ptr_end - info_ptr;
|
||||||
|
+ if (!die_ref || die_ref >= total)
|
||||||
|
{
|
||||||
|
_bfd_error_handler
|
||||||
|
- (_("Dwarf Error: Abstract instance DIE ref zero."));
|
||||||
|
+ (_("Dwarf Error: Invalid abstract instance DIE ref."));
|
||||||
|
bfd_set_error (bfd_error_bad_value);
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
-
|
||||||
|
- info_ptr = unit->sec_info_ptr + die_ref;
|
||||||
|
- info_ptr_end = unit->end_ptr;
|
||||||
|
+ info_ptr += die_ref;
|
||||||
|
|
||||||
|
/* Now find the CU containing this pointer. */
|
||||||
|
if (info_ptr >= unit->info_ptr_unit && info_ptr < unit->end_ptr)
|
||||||
|
- ;
|
||||||
|
+ info_ptr_end = unit->end_ptr;
|
||||||
|
else
|
||||||
|
{
|
||||||
|
/* Check other CUs to see if they contain the abbrev. */
|
||||||
|
@@ -2324,7 +2336,10 @@
|
||||||
|
break;
|
||||||
|
|
||||||
|
if (u)
|
||||||
|
- unit = u;
|
||||||
|
+ {
|
||||||
|
+ unit = u;
|
||||||
|
+ info_ptr_end = unit->end_ptr;
|
||||||
|
+ }
|
||||||
|
/* else FIXME: What do we do now ? */
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -2346,8 +2361,22 @@
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
- info_ptr = unit->info_ptr_unit + die_ref;
|
||||||
|
+ /* DW_FORM_ref1, DW_FORM_ref2, DW_FORM_ref4, DW_FORM_ref8 or
|
||||||
|
+ DW_FORM_ref_udata. These are all references relative to the
|
||||||
|
+ start of the current CU. */
|
||||||
|
+ size_t total;
|
||||||
|
+
|
||||||
|
+ info_ptr = unit->info_ptr_unit;
|
||||||
|
info_ptr_end = unit->end_ptr;
|
||||||
|
+ total = info_ptr_end - info_ptr;
|
||||||
|
+ if (!die_ref || die_ref >= total)
|
||||||
|
+ {
|
||||||
|
+ _bfd_error_handler
|
||||||
|
+ (_("Dwarf Error: Invalid abstract instance DIE ref."));
|
||||||
|
+ bfd_set_error (bfd_error_bad_value);
|
||||||
|
+ return FALSE;
|
||||||
|
+ }
|
||||||
|
+ info_ptr += die_ref;
|
||||||
|
}
|
||||||
|
|
||||||
|
abbrev_number = safe_read_leb128 (abfd, info_ptr, &bytes_read, FALSE, info_ptr_end);
|
||||||
|
@@ -2846,7 +2875,6 @@
|
||||||
|
unit->end_ptr = end_ptr;
|
||||||
|
unit->stash = stash;
|
||||||
|
unit->info_ptr_unit = info_ptr_unit;
|
||||||
|
- unit->sec_info_ptr = stash->sec_info_ptr;
|
||||||
|
|
||||||
|
for (i = 0; i < abbrev->num_attrs; ++i)
|
||||||
|
{
|
||||||
|
Index: git/bfd/ChangeLog
|
||||||
|
===================================================================
|
||||||
|
--- git.orig/bfd/ChangeLog 2017-11-07 18:52:19.900253395 +0530
|
||||||
|
+++ git/bfd/ChangeLog 2017-11-07 18:53:29.668799630 +0530
|
||||||
|
@@ -1,3 +1,12 @@
|
||||||
|
+2017-09-26 Alan Modra <amodra@gmail.com>
|
||||||
|
+
|
||||||
|
+ PR 22209
|
||||||
|
+ * dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
|
||||||
|
+ (find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
|
||||||
|
+ to stash->info_ptr_memory, and check die_ref is within that memory.
|
||||||
|
+ Set info_ptr_end correctly when another CU is refd. Check die_ref
|
||||||
|
+ for DW_FORM_ref4 etc. is within CU.
|
||||||
|
+
|
||||||
|
2017-09-24 Alan Modra <amodra@gmail.com>
|
||||||
|
|
||||||
|
PR 22187
|
||||||
Reference in New Issue
Block a user