mirror of
https://git.yoctoproject.org/poky
synced 2026-02-22 17:39:39 +01:00
e6fdc8959b
Affects: <= 2.29.1 (From OE-Core rev: 86c54c4770ce207575e29c589732c74e68d9ff3c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
59 lines
2.2 KiB
Diff
59 lines
2.2 KiB
Diff
From d785b7d4b877ed465d04072e17ca19d0f47d840f Mon Sep 17 00:00:00 2001
|
|
From: Nick Clifton <nickc@redhat.com>
|
|
Date: Wed, 29 Nov 2017 12:40:43 +0000
|
|
Subject: [PATCH] Stop objdump from attempting to allocate a huge chunk of
|
|
memory when parsing relocs in a corrupt file.
|
|
|
|
PR 22508
|
|
* objdump.c (dump_relocs_in_section): Also check the section's
|
|
relocation count to make sure that it is reasonable before
|
|
attempting to allocate space for the relocs.
|
|
|
|
Upstream-Status: Backport
|
|
Affects: <= 2.29.1
|
|
CVE: CVE-2017-17122
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
binutils/ChangeLog | 7 +++++++
|
|
binutils/objdump.c | 11 ++++++++++-
|
|
2 files changed, 17 insertions(+), 1 deletion(-)
|
|
|
|
Index: git/binutils/objdump.c
|
|
===================================================================
|
|
--- git.orig/binutils/objdump.c
|
|
+++ git/binutils/objdump.c
|
|
@@ -3381,7 +3381,16 @@ dump_relocs_in_section (bfd *abfd,
|
|
}
|
|
|
|
if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0
|
|
- && (ufile_ptr) relsize > bfd_get_file_size (abfd))
|
|
+ && (((ufile_ptr) relsize > bfd_get_file_size (abfd))
|
|
+ /* Also check the section's reloc count since if this is negative
|
|
+ (or very large) the computation in bfd_get_reloc_upper_bound
|
|
+ may have resulted in returning a small, positive integer.
|
|
+ See PR 22508 for a reproducer.
|
|
+
|
|
+ Note - we check against file size rather than section size as
|
|
+ it is possible for there to be more relocs that apply to a
|
|
+ section than there are bytes in that section. */
|
|
+ || (section->reloc_count > bfd_get_file_size (abfd))))
|
|
{
|
|
printf (" (too many: 0x%x)\n", section->reloc_count);
|
|
bfd_set_error (bfd_error_file_truncated);
|
|
Index: git/binutils/ChangeLog
|
|
===================================================================
|
|
--- git.orig/binutils/ChangeLog
|
|
+++ git/binutils/ChangeLog
|
|
@@ -1,3 +1,10 @@
|
|
+2017-11-29 Nick Clifton <nickc@redhat.com>
|
|
+
|
|
+ PR 22508
|
|
+ * objdump.c (dump_relocs_in_section): Also check the section's
|
|
+ relocation count to make sure that it is reasonable before
|
|
+ attempting to allocate space for the relocs.
|
|
+
|
|
2017-11-02 Mingi Cho <mgcho.minic@gmail.com>
|
|
|
|
PR 22384
|