mirror of
https://git.yoctoproject.org/poky
synced 2026-03-03 22:09:39 +01:00
600b508c37
(From OE-Core rev: 7a42ae332ebde565cc7c6fca568563f076bd26ba) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
152 lines
4.3 KiB
Diff
152 lines
4.3 KiB
Diff
From: Alan Modra <amodra@gmail.com>
|
|
Date: Sun, 30 Oct 2022 08:38:51 +0000 (+1030)
|
|
Subject: Pool section entries for DWP version 1
|
|
X-Git-Tag: gdb-13-branchpoint~664
|
|
X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=28750e3b967da2207d51cbce9fc8be262817ee59
|
|
|
|
Pool section entries for DWP version 1
|
|
|
|
Ref: https://gcc.gnu.org/wiki/DebugFissionDWP?action=recall&rev=3
|
|
|
|
Fuzzers have found a weakness in the code stashing pool section
|
|
entries. With random nonsensical values in the index entries (rather
|
|
than each index pointing to its own set distinct from other sets),
|
|
it's possible to overflow the space allocated, losing the NULL
|
|
terminator. Without a terminator, find_section_in_set can run off the
|
|
end of the shndx_pool buffer. Fix this by scanning the pool directly.
|
|
|
|
binutils/
|
|
* dwarf.c (add_shndx_to_cu_tu_entry): Delete range check.
|
|
(end_cu_tu_entry): Likewise.
|
|
(process_cu_tu_index): Fill shndx_pool by directly scanning
|
|
pool, rather than indirectly from index entries.
|
|
|
|
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=binutils/dwarf.c;h=7730293326ac1049451eb4a037ac86d827030700;hp=c6340a28906114e9df29d7401472c7dc0a98c2b1;hb=28750e3b967da2207d51cbce9fc8be262817ee59;hpb=60095ba3b8f8ba26a6389dded732fa446422c98f]
|
|
|
|
CVE: CVE-2022-44840
|
|
|
|
Signed-off-by: yash shinde <yash.shinde@windriver.com>
|
|
|
|
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
|
|
index c6340a28906..7730293326a 100644
|
|
--- a/binutils/dwarf.c
|
|
+++ b/binutils/dwarf.c
|
|
@@ -10652,22 +10652,12 @@ prealloc_cu_tu_list (unsigned int nshndx)
|
|
static void
|
|
add_shndx_to_cu_tu_entry (unsigned int shndx)
|
|
{
|
|
- if (shndx_pool_used >= shndx_pool_size)
|
|
- {
|
|
- error (_("Internal error: out of space in the shndx pool.\n"));
|
|
- return;
|
|
- }
|
|
shndx_pool [shndx_pool_used++] = shndx;
|
|
}
|
|
|
|
static void
|
|
end_cu_tu_entry (void)
|
|
{
|
|
- if (shndx_pool_used >= shndx_pool_size)
|
|
- {
|
|
- error (_("Internal error: out of space in the shndx pool.\n"));
|
|
- return;
|
|
- }
|
|
shndx_pool [shndx_pool_used++] = 0;
|
|
}
|
|
|
|
@@ -10773,53 +10763,55 @@ process_cu_tu_index (struct dwarf_section *section, int do_display)
|
|
|
|
if (version == 1)
|
|
{
|
|
+ unsigned char *shndx_list;
|
|
+ unsigned int shndx;
|
|
+
|
|
if (!do_display)
|
|
- prealloc_cu_tu_list ((limit - ppool) / 4);
|
|
- for (i = 0; i < nslots; i++)
|
|
{
|
|
- unsigned char *shndx_list;
|
|
- unsigned int shndx;
|
|
-
|
|
- SAFE_BYTE_GET (signature, phash, 8, limit);
|
|
- if (signature != 0)
|
|
+ prealloc_cu_tu_list ((limit - ppool) / 4);
|
|
+ for (shndx_list = ppool + 4; shndx_list <= limit - 4; shndx_list += 4)
|
|
{
|
|
- SAFE_BYTE_GET (j, pindex, 4, limit);
|
|
- shndx_list = ppool + j * 4;
|
|
- /* PR 17531: file: 705e010d. */
|
|
- if (shndx_list < ppool)
|
|
- {
|
|
- warn (_("Section index pool located before start of section\n"));
|
|
- return 0;
|
|
- }
|
|
+ shndx = byte_get (shndx_list, 4);
|
|
+ add_shndx_to_cu_tu_entry (shndx);
|
|
+ }
|
|
+ end_cu_tu_entry ();
|
|
+ }
|
|
+ else
|
|
+ for (i = 0; i < nslots; i++)
|
|
+ {
|
|
+ SAFE_BYTE_GET (signature, phash, 8, limit);
|
|
+ if (signature != 0)
|
|
+ {
|
|
+ SAFE_BYTE_GET (j, pindex, 4, limit);
|
|
+ shndx_list = ppool + j * 4;
|
|
+ /* PR 17531: file: 705e010d. */
|
|
+ if (shndx_list < ppool)
|
|
+ {
|
|
+ warn (_("Section index pool located before start of section\n"));
|
|
+ return 0;
|
|
+ }
|
|
|
|
- if (do_display)
|
|
printf (_(" [%3d] Signature: 0x%s Sections: "),
|
|
i, dwarf_vmatoa ("x", signature));
|
|
- for (;;)
|
|
- {
|
|
- if (shndx_list >= limit)
|
|
- {
|
|
- warn (_("Section %s too small for shndx pool\n"),
|
|
- section->name);
|
|
- return 0;
|
|
- }
|
|
- SAFE_BYTE_GET (shndx, shndx_list, 4, limit);
|
|
- if (shndx == 0)
|
|
- break;
|
|
- if (do_display)
|
|
+ for (;;)
|
|
+ {
|
|
+ if (shndx_list >= limit)
|
|
+ {
|
|
+ warn (_("Section %s too small for shndx pool\n"),
|
|
+ section->name);
|
|
+ return 0;
|
|
+ }
|
|
+ SAFE_BYTE_GET (shndx, shndx_list, 4, limit);
|
|
+ if (shndx == 0)
|
|
+ break;
|
|
printf (" %d", shndx);
|
|
- else
|
|
- add_shndx_to_cu_tu_entry (shndx);
|
|
- shndx_list += 4;
|
|
- }
|
|
- if (do_display)
|
|
+ shndx_list += 4;
|
|
+ }
|
|
printf ("\n");
|
|
- else
|
|
- end_cu_tu_entry ();
|
|
- }
|
|
- phash += 8;
|
|
- pindex += 4;
|
|
- }
|
|
+ }
|
|
+ phash += 8;
|
|
+ pindex += 4;
|
|
+ }
|
|
}
|
|
else if (version == 2)
|
|
{
|