mirror of
https://git.yoctoproject.org/poky
synced 2026-02-09 10:13:03 +01:00
6beec1687f
(From OE-Core rev: 093f0914f261a27d58ecba9c1e9d3b78a35af012) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
52 lines
1.5 KiB
Diff
52 lines
1.5 KiB
Diff
From 30bcc01478433a1cb05b36dc5c4beef7d2c89b5b Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Fri, 21 Jun 2019 11:51:38 +0930
|
|
Subject: [PATCH] PR24689, string table corruption
|
|
|
|
The testcase in the PR had a e_shstrndx section of type SHT_GROUP.
|
|
hdr->contents were initialized by setup_group rather than being read
|
|
from the file, thus last byte was not zero and string dereference ran
|
|
off the end of the buffer.
|
|
|
|
PR 24689
|
|
* elfcode.h (elf_object_p): Check type of e_shstrndx section.
|
|
|
|
Upstream-Status: Backport
|
|
CVE: CVE-2019-12972
|
|
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
|
|
---
|
|
bfd/ChangeLog | 5 +++++
|
|
bfd/elfcode.h | 3 ++-
|
|
2 files changed, 7 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
|
|
index 91f09e6346..e66fb40a2c 100644
|
|
--- a/bfd/ChangeLog
|
|
+++ b/bfd/ChangeLog
|
|
@@ -1,3 +1,8 @@
|
|
+2019-06-21 Alan Modra <amodra@gmail.com>
|
|
+
|
|
+ PR 24689
|
|
+ * elfcode.h (elf_object_p): Check type of e_shstrndx section.
|
|
+
|
|
2019-02-20 Alan Modra <amodra@gmail.com>
|
|
|
|
PR 24236
|
|
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
|
|
index ec5ea766de..a35a629087 100644
|
|
--- a/bfd/elfcode.h
|
|
+++ b/bfd/elfcode.h
|
|
@@ -755,7 +755,8 @@ elf_object_p (bfd *abfd)
|
|
/* A further sanity check. */
|
|
if (i_ehdrp->e_shnum != 0)
|
|
{
|
|
- if (i_ehdrp->e_shstrndx >= elf_numsections (abfd))
|
|
+ if (i_ehdrp->e_shstrndx >= elf_numsections (abfd)
|
|
+ || i_shdrp[i_ehdrp->e_shstrndx].sh_type != SHT_STRTAB)
|
|
{
|
|
/* PR 2257:
|
|
We used to just goto got_wrong_format_error here
|
|
--
|
|
2.20.1
|
|
|