| From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001 |
| From: Alan Modra <amodra@gmail.com> |
| Date: Sat, 27 Jan 2018 08:19:33 +1030 |
| Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object |
| |
| PR 22741 |
| * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in |
| range before converting to a symbol table pointer. |
| |
| Upstream-Status: Backport |
| Affects: Binutils <= 2.30 |
| CVE: CVE-2018-7208 |
| Signed-off-by: Armin Kuster <akuster@mvista.com> |
| |
| --- |
| bfd/ChangeLog | 6 ++++++ |
| bfd/coffgen.c | 3 ++- |
| 2 files changed, 8 insertions(+), 1 deletion(-) |
| |
| Index: git/bfd/coffgen.c |
| =================================================================== |
| --- git.orig/bfd/coffgen.c |
| +++ git/bfd/coffgen.c |
| @@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd, |
| } |
| /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can |
| generate one, so we must be careful to ignore it. */ |
| - if (auxent->u.auxent.x_sym.x_tagndx.l > 0) |
| + if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l |
| + < obj_raw_syment_count (abfd)) |
| { |
| auxent->u.auxent.x_sym.x_tagndx.p = |
| table_base + auxent->u.auxent.x_sym.x_tagndx.l; |
| Index: git/bfd/ChangeLog |
| =================================================================== |
| --- git.orig/bfd/ChangeLog |
| +++ git/bfd/ChangeLog |
| @@ -1,3 +1,9 @@ |
| +2018-01-29 Alan Modra <amodra@gmail.com> |
| + |
| + PR 22741 |
| + * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in |
| + range before converting to a symbol table pointer. |
| + |
| 2018-02-28 Alan Modra <amodra@gmail.com> |
| |
| PR 22887 |