mirror of
https://git.yoctoproject.org/poky
synced 2026-04-01 05:02:21 +02:00
5f6bb8fe3d
Source: binutils-gdb.git
MR: 73958, 73945
Type: Security Fix
Disposition: Backport from binutils-2_29
ChangeID: a39fdc82900af3f5d6ae396c913ac902f4ef7f60
Description:
Fix seg-faults in objdump when disassembling a corrupt versados binary.
PR binutils/21591
* versados.c (versados_mkobject): Zero the allocated tdata structure.
(process_otr): Check for an invalid offset in the otr structure.
Affects: <= 2.28
Author: Nick Clifton <nickc@redhat.com>
(From OE-Core rev: 7d46daa5e580e841f83b9070b3c84e87d8fd1181)
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
77 lines
2.2 KiB
Diff
77 lines
2.2 KiB
Diff
commit 04f963fd489cae724a60140e13984415c205f4ac
|
|
Author: Nick Clifton <nickc@redhat.com>
|
|
Date: Wed Jun 14 10:35:16 2017 +0100
|
|
|
|
Fix seg-faults in objdump when disassembling a corrupt versados binary.
|
|
|
|
PR binutils/21591
|
|
* versados.c (versados_mkobject): Zero the allocated tdata structure.
|
|
(process_otr): Check for an invalid offset in the otr structure.
|
|
|
|
Upstream-Status: Backport
|
|
|
|
CVE: CVE-2017-9753 and CVE-2017-9754
|
|
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
|
|
|
Index: git/bfd/versados.c
|
|
===================================================================
|
|
--- git.orig/bfd/versados.c 2017-09-21 15:08:34.445197987 +0530
|
|
+++ git/bfd/versados.c 2017-09-21 15:08:34.429197878 +0530
|
|
@@ -149,7 +149,7 @@
|
|
if (abfd->tdata.versados_data == NULL)
|
|
{
|
|
bfd_size_type amt = sizeof (tdata_type);
|
|
- tdata_type *tdata = bfd_alloc (abfd, amt);
|
|
+ tdata_type *tdata = bfd_zalloc (abfd, amt);
|
|
|
|
if (tdata == NULL)
|
|
return FALSE;
|
|
@@ -344,13 +344,13 @@
|
|
};
|
|
|
|
static int
|
|
-get_offset (int len, unsigned char *ptr)
|
|
+get_offset (unsigned int len, unsigned char *ptr)
|
|
{
|
|
int val = 0;
|
|
|
|
if (len)
|
|
{
|
|
- int i;
|
|
+ unsigned int i;
|
|
|
|
val = *ptr++;
|
|
if (val & 0x80)
|
|
@@ -393,9 +393,13 @@
|
|
int flag = *srcp++;
|
|
int esdids = (flag >> 5) & 0x7;
|
|
int sizeinwords = ((flag >> 3) & 1) ? 2 : 1;
|
|
- int offsetlen = flag & 0x7;
|
|
+ unsigned int offsetlen = flag & 0x7;
|
|
int j;
|
|
|
|
+ /* PR 21591: Check for invalid lengths. */
|
|
+ if (srcp + esdids + offsetlen >= endp)
|
|
+ return;
|
|
+
|
|
if (esdids == 0)
|
|
{
|
|
/* A zero esdid means the new pc is the offset given. */
|
|
Index: git/bfd/ChangeLog
|
|
===================================================================
|
|
--- git.orig/bfd/ChangeLog 2017-09-21 15:08:34.445197987 +0530
|
|
+++ git/bfd/ChangeLog 2017-09-21 15:08:34.429197878 +0530
|
|
@@ -90,6 +90,12 @@
|
|
(_bfd_vms_slurp_etir): Add checks for attempts to read beyond the
|
|
end of etir record.
|
|
|
|
+2017-06-14 Nick Clifton <nickc@redhat.com>
|
|
+
|
|
+ PR binutils/21591
|
|
+ * versados.c (versados_mkobject): Zero the allocated tdata structure.
|
|
+ (process_otr): Check for an invalid offset in the otr structure.
|
|
+
|
|
2017-04-29 Alan Modra <amodra@gmail.com>
|
|
|
|
PR 21432
|