mirror of
https://git.yoctoproject.org/poky
synced 2026-02-22 17:39:39 +01:00
d40d4bf86f
Affects: <= 2.29.1 (From OE-Core rev: ab9e8161a3b89914d8664175a684675bc99d6f21) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
78 lines
2.6 KiB
Diff
78 lines
2.6 KiB
Diff
From 6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca Mon Sep 17 00:00:00 2001
|
|
From: Nick Clifton <nickc@redhat.com>
|
|
Date: Fri, 3 Nov 2017 11:55:21 +0000
|
|
Subject: [PATCH] Fix excessive memory allocation attempts and possible integer
|
|
overfloaws when attempting to read a COFF binary with a corrupt symbol count.
|
|
|
|
PR 22385
|
|
* coffgen.c (_bfd_coff_get_external_symbols): Check for an
|
|
overlarge raw syment count.
|
|
(coff_get_normalized_symtab): Likewise.
|
|
|
|
Upstream-Status: Backport
|
|
Affects: <= 2.29.1
|
|
CVE: CVE-2017-16831
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
bfd/ChangeLog | 8 ++++++++
|
|
bfd/coffgen.c | 17 +++++++++++++++--
|
|
2 files changed, 23 insertions(+), 2 deletions(-)
|
|
|
|
Index: git/bfd/ChangeLog
|
|
===================================================================
|
|
--- git.orig/bfd/ChangeLog
|
|
+++ git/bfd/ChangeLog
|
|
@@ -1,3 +1,11 @@
|
|
+2017-11-03 Mingi Cho <mgcho.minic@gmail.com>
|
|
+ Nick Clifton <nickc@redhat.com>
|
|
+
|
|
+ PR 22385
|
|
+ * coffgen.c (_bfd_coff_get_external_symbols): Check for an
|
|
+ overlarge raw syment count.
|
|
+ (coff_get_normalized_symtab): Likewise.
|
|
+
|
|
2017-10-17 Alan Modra <amodra@gmail.com>
|
|
|
|
PR 22307
|
|
Index: git/bfd/coffgen.c
|
|
===================================================================
|
|
--- git.orig/bfd/coffgen.c
|
|
+++ git/bfd/coffgen.c
|
|
@@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abf
|
|
size = obj_raw_syment_count (abfd) * symesz;
|
|
if (size == 0)
|
|
return TRUE;
|
|
+ /* Check for integer overflow and for unreasonable symbol counts. */
|
|
+ if (size < obj_raw_syment_count (abfd)
|
|
+ || (bfd_get_file_size (abfd) > 0
|
|
+ && size > bfd_get_file_size (abfd)))
|
|
+
|
|
+ {
|
|
+ _bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
|
|
+ abfd, obj_raw_syment_count (abfd));
|
|
+ return FALSE;
|
|
+ }
|
|
|
|
syms = bfd_malloc (size);
|
|
if (syms == NULL)
|
|
{
|
|
/* PR 21013: Provide an error message when the alloc fails. */
|
|
- _bfd_error_handler (_("%B: Not enough memory to allocate space for %lu symbols"),
|
|
- abfd, size);
|
|
+ _bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
|
|
+ abfd, obj_raw_syment_count (abfd), symesz);
|
|
return FALSE;
|
|
}
|
|
|
|
@@ -1790,6 +1800,9 @@ coff_get_normalized_symtab (bfd *abfd)
|
|
return NULL;
|
|
|
|
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
|
|
+ /* Check for integer overflow. */
|
|
+ if (size < obj_raw_syment_count (abfd))
|
|
+ return NULL;
|
|
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
|
|
if (internal == NULL && size != 0)
|
|
return NULL;
|