aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2020-09-04 19:19:18 +0930
committerAndreas K. Hüttel <dilfridge@gentoo.org>2021-02-07 02:10:05 +0200
commit68d5bbdfaecac542895100ac9f93e49e7a4cf551 (patch)
treef25d09052e9d6e7d56832fffd9ea73eacd39ec7b
parentld: Override the IR definition for non-ELF targets (diff)
downloadbinutils-gdb-gentoo/binutils-2.35.2-1.tar.gz
binutils-gdb-gentoo/binutils-2.35.2-1.tar.bz2
binutils-gdb-gentoo/binutils-2.35.2-1.zip
PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_sectiongentoo/binutils-2.35.2-1gentoo/binutils-2.35.2
A horribly fuzzed object with section headers inside the ELF header. Disallow that, and crazy reloc sizes. PR 26574 * elfcode.h (elf_object_p): Sanity check section header offset. * elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check sh_entsize. (cherry picked from commit 8642dafaef21aa6747cec01df1977e9c52eb4679)
-rw-r--r--bfd/ChangeLog7
-rw-r--r--bfd/elf.c4
-rw-r--r--bfd/elfcode.h8
3 files changed, 14 insertions, 5 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 13d3670460..70805d71e6 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -53,6 +53,13 @@
* dwarf2.c (read_rnglists): Advance rngs_ptr after
_bfd_safe_read_leb128 when parsing DW_RLE_offset_pair.
+2020-09-04 Alan Modra <amodra@gmail.com>
+
+ PR 26574
+ * elfcode.h (elf_object_p): Sanity check section header offset.
+ * elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
+ sh_entsize.
+
2021-01-01 Alan Modra <amodra@gmail.com>
Apply from master
diff --git a/bfd/elf.c b/bfd/elf.c
index fe375e7346..9f29166399 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -12527,7 +12527,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd * abfd,
Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
if (hdr->sh_type == SHT_SECONDARY_RELOC
- && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
+ && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
+ && (hdr->sh_entsize == ebd->s->sizeof_rel
+ || hdr->sh_entsize == ebd->s->sizeof_rela))
{
bfd_byte * native_relocs;
bfd_byte * native_reloc;
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
index f4a7829f27..54ef890637 100644
--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
@@ -568,7 +568,7 @@ elf_object_p (bfd *abfd)
/* If this is a relocatable file and there is no section header
table, then we're hosed. */
- if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
+ if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
goto got_wrong_format_error;
/* As a simple sanity check, verify that what BFD thinks is the
@@ -578,7 +578,7 @@ elf_object_p (bfd *abfd)
goto got_wrong_format_error;
/* Further sanity check. */
- if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
+ if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
goto got_wrong_format_error;
ebd = get_elf_backend_data (abfd);
@@ -615,7 +615,7 @@ elf_object_p (bfd *abfd)
&& ebd->elf_osabi != ELFOSABI_NONE)
goto got_wrong_format_error;
- if (i_ehdrp->e_shoff != 0)
+ if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
{
file_ptr where = (file_ptr) i_ehdrp->e_shoff;
@@ -807,7 +807,7 @@ elf_object_p (bfd *abfd)
}
}
- if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
+ if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
{
unsigned int num_sec;