Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame^] | 1 | From 0930cb3021b8078b34cf216e79eb8608d017864f Mon Sep 17 00:00:00 2001 |
| 2 | From: Alan Modra <amodra@gmail.com> |
| 3 | Date: Sat, 13 Oct 2018 22:03:02 +1030 |
| 4 | Subject: [PATCH] _bfd_clear_contents bounds checking |
| 5 | |
| 6 | This PR shows a fuzzed binary triggering a segfault via a bad |
| 7 | relocation in .debug_line. It turns out that unlike normal |
| 8 | relocations applied to a section, the linker applies those with |
| 9 | symbols from discarded sections via _bfd_clear_contents without |
| 10 | checking that the relocation is within the section bounds. The same |
| 11 | thing now happens when reading debug sections since commit |
| 12 | a4cd947aca23, the PR23425 fix. |
| 13 | |
| 14 | PR 23770 |
| 15 | PR 23425 |
| 16 | * reloc.c (_bfd_clear_contents): Replace "location" param with |
| 17 | "buf" and "off". Bounds check "off". Return status. |
| 18 | * cofflink.c (_bfd_coff_generic_relocate_section): Update |
| 19 | _bfd_clear_contents call. |
| 20 | * elf-bfd.h (RELOC_AGAINST_DISCARDED_SECTION): Likewise. |
| 21 | * elf32-arc.c (elf_arc_relocate_section): Likewise. |
| 22 | * elf32-i386.c (elf_i386_relocate_section): Likewise. |
| 23 | * elf32-metag.c (metag_final_link_relocate): Likewise. |
| 24 | * elf32-nds32.c (nds32_elf_get_relocated_section_contents): Likewise. |
| 25 | * elf32-ppc.c (ppc_elf_relocate_section): Likewise. |
| 26 | * elf32-visium.c (visium_elf_relocate_section): Likewise. |
| 27 | * elf64-ppc.c (ppc64_elf_relocate_section): Likewise. |
| 28 | * elf64-x86-64.c *(elf_x86_64_relocate_section): Likewise. |
| 29 | * libbfd-in.h (_bfd_clear_contents): Update prototype. |
| 30 | * libbfd.h: Regenerate. |
| 31 | |
| 32 | Upstream-Status: Backport |
| 33 | CVE: CVE-2018-18605 |
| 34 | Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> |
| 35 | --- |
| 36 | bfd/ChangeLog | 20 ++++++++++++++++++++ |
| 37 | bfd/cofflink.c | 2 +- |
| 38 | bfd/elf-bfd.h | 2 +- |
| 39 | bfd/elf32-arc.c | 2 +- |
| 40 | bfd/elf32-i386.c | 2 +- |
| 41 | bfd/elf32-metag.c | 2 +- |
| 42 | bfd/elf32-nds32.c | 8 ++++---- |
| 43 | bfd/elf32-ppc.c | 2 +- |
| 44 | bfd/elf32-visium.c | 2 +- |
| 45 | bfd/elf64-ppc.c | 2 +- |
| 46 | bfd/elf64-x86-64.c | 2 +- |
| 47 | bfd/libbfd-in.h | 4 ++-- |
| 48 | bfd/libbfd.h | 4 ++-- |
| 49 | bfd/reloc.c | 19 +++++++++++++------ |
| 50 | 14 files changed, 50 insertions(+), 23 deletions(-) |
| 51 | |
| 52 | diff --git a/bfd/ChangeLog b/bfd/ChangeLog |
| 53 | index 68c1ff665b..e9696ee314 100644 |
| 54 | --- a/bfd/ChangeLog |
| 55 | +++ b/bfd/ChangeLog |
| 56 | @@ -1,3 +1,23 @@ |
| 57 | +2018-10-13 Alan Modra <amodra@gmail.com> |
| 58 | + |
| 59 | + PR 23770 |
| 60 | + PR 23425 |
| 61 | + * reloc.c (_bfd_clear_contents): Replace "location" param with |
| 62 | + "buf" and "off". Bounds check "off". Return status. |
| 63 | + * cofflink.c (_bfd_coff_generic_relocate_section): Update |
| 64 | + _bfd_clear_contents call. |
| 65 | + * elf-bfd.h (RELOC_AGAINST_DISCARDED_SECTION): Likewise. |
| 66 | + * elf32-arc.c (elf_arc_relocate_section): Likewise. |
| 67 | + * elf32-i386.c (elf_i386_relocate_section): Likewise. |
| 68 | + * elf32-metag.c (metag_final_link_relocate): Likewise. |
| 69 | + * elf32-nds32.c (nds32_elf_get_relocated_section_contents): Likewise. |
| 70 | + * elf32-ppc.c (ppc_elf_relocate_section): Likewise. |
| 71 | + * elf32-visium.c (visium_elf_relocate_section): Likewise. |
| 72 | + * elf64-ppc.c (ppc64_elf_relocate_section): Likewise. |
| 73 | + * elf64-x86-64.c *(elf_x86_64_relocate_section): Likewise. |
| 74 | + * libbfd-in.h (_bfd_clear_contents): Update prototype. |
| 75 | + * libbfd.h: Regenerate. |
| 76 | + |
| 77 | 2018-09-20 Alan Modra <amodra@gmail.com> |
| 78 | |
| 79 | PR 23685 |
| 80 | diff --git a/bfd/cofflink.c b/bfd/cofflink.c |
| 81 | index 2f73f72e31..b7ea69b7f9 100644 |
| 82 | --- a/bfd/cofflink.c |
| 83 | +++ b/bfd/cofflink.c |
| 84 | @@ -3080,7 +3080,7 @@ _bfd_coff_generic_relocate_section (bfd *output_bfd, |
| 85 | if (sec != NULL && discarded_section (sec)) |
| 86 | { |
| 87 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 88 | - contents + (rel->r_vaddr - input_section->vma)); |
| 89 | + contents, rel->r_vaddr - input_section->vma); |
| 90 | continue; |
| 91 | } |
| 92 | |
| 93 | diff --git a/bfd/elf-bfd.h b/bfd/elf-bfd.h |
| 94 | index cf256f70e0..3374f411f9 100644 |
| 95 | --- a/bfd/elf-bfd.h |
| 96 | +++ b/bfd/elf-bfd.h |
| 97 | @@ -2811,7 +2811,7 @@ extern asection _bfd_elf_large_com_section; |
| 98 | { \ |
| 99 | int i_; \ |
| 100 | _bfd_clear_contents (howto, input_bfd, input_section, \ |
| 101 | - contents + rel[index].r_offset); \ |
| 102 | + contents, rel[index].r_offset); \ |
| 103 | \ |
| 104 | if (bfd_link_relocatable (info) \ |
| 105 | && (input_section->flags & SEC_DEBUGGING)) \ |
| 106 | diff --git a/bfd/elf32-arc.c b/bfd/elf32-arc.c |
| 107 | index 7a1b3042ae..30f47a5b22 100644 |
| 108 | --- a/bfd/elf32-arc.c |
| 109 | +++ b/bfd/elf32-arc.c |
| 110 | @@ -1549,7 +1549,7 @@ elf_arc_relocate_section (bfd * output_bfd, |
| 111 | if (sec != NULL && discarded_section (sec)) |
| 112 | { |
| 113 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 114 | - contents + rel->r_offset); |
| 115 | + contents, rel->r_offset); |
| 116 | rel->r_info = 0; |
| 117 | rel->r_addend = 0; |
| 118 | |
| 119 | diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c |
| 120 | index 49797dcbfa..177471777d 100644 |
| 121 | --- a/bfd/elf32-i386.c |
| 122 | +++ b/bfd/elf32-i386.c |
| 123 | @@ -2197,7 +2197,7 @@ elf_i386_relocate_section (bfd *output_bfd, |
| 124 | if (sec != NULL && discarded_section (sec)) |
| 125 | { |
| 126 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 127 | - contents + rel->r_offset); |
| 128 | + contents, rel->r_offset); |
| 129 | wrel->r_offset = rel->r_offset; |
| 130 | wrel->r_info = 0; |
| 131 | wrel->r_addend = 0; |
| 132 | diff --git a/bfd/elf32-metag.c b/bfd/elf32-metag.c |
| 133 | index efe95bddff..7f96246e5d 100644 |
| 134 | --- a/bfd/elf32-metag.c |
| 135 | +++ b/bfd/elf32-metag.c |
| 136 | @@ -1396,7 +1396,7 @@ metag_final_link_relocate (reloc_howto_type *howto, |
| 137 | rel, relend, howto, contents) \ |
| 138 | { \ |
| 139 | _bfd_clear_contents (howto, input_bfd, input_section, \ |
| 140 | - contents + rel->r_offset); \ |
| 141 | + contents, rel->r_offset); \ |
| 142 | \ |
| 143 | if (bfd_link_relocatable (info) \ |
| 144 | && (input_section->flags & SEC_DEBUGGING)) \ |
| 145 | diff --git a/bfd/elf32-nds32.c b/bfd/elf32-nds32.c |
| 146 | index 0d86e5b865..184cf320f7 100644 |
| 147 | --- a/bfd/elf32-nds32.c |
| 148 | +++ b/bfd/elf32-nds32.c |
| 149 | @@ -12582,14 +12582,14 @@ nds32_elf_get_relocated_section_contents (bfd *abfd, |
| 150 | symbol = *(*parent)->sym_ptr_ptr; |
| 151 | if (symbol->section && discarded_section (symbol->section)) |
| 152 | { |
| 153 | - bfd_byte *p; |
| 154 | + bfd_vma off; |
| 155 | static reloc_howto_type none_howto |
| 156 | = HOWTO (0, 0, 0, 0, FALSE, 0, complain_overflow_dont, NULL, |
| 157 | "unused", FALSE, 0, 0, FALSE); |
| 158 | |
| 159 | - p = data + (*parent)->address * bfd_octets_per_byte (input_bfd); |
| 160 | - _bfd_clear_contents ((*parent)->howto, input_bfd, input_section, |
| 161 | - p); |
| 162 | + off = (*parent)->address * bfd_octets_per_byte (input_bfd); |
| 163 | + _bfd_clear_contents ((*parent)->howto, input_bfd, |
| 164 | + input_section, data, off); |
| 165 | (*parent)->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; |
| 166 | (*parent)->addend = 0; |
| 167 | (*parent)->howto = &none_howto; |
| 168 | diff --git a/bfd/elf32-ppc.c b/bfd/elf32-ppc.c |
| 169 | index 61f70de12e..c31e26efd7 100644 |
| 170 | --- a/bfd/elf32-ppc.c |
| 171 | +++ b/bfd/elf32-ppc.c |
| 172 | @@ -8232,7 +8232,7 @@ ppc_elf_relocate_section (bfd *output_bfd, |
| 173 | howto = ppc_elf_howto_table[r_type]; |
| 174 | |
| 175 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 176 | - contents + rel->r_offset); |
| 177 | + contents, rel->r_offset); |
| 178 | wrel->r_offset = rel->r_offset; |
| 179 | wrel->r_info = 0; |
| 180 | wrel->r_addend = 0; |
| 181 | diff --git a/bfd/elf32-visium.c b/bfd/elf32-visium.c |
| 182 | index e8f1c4c9e4..961366cd87 100644 |
| 183 | --- a/bfd/elf32-visium.c |
| 184 | +++ b/bfd/elf32-visium.c |
| 185 | @@ -621,7 +621,7 @@ visium_elf_relocate_section (bfd *output_bfd, |
| 186 | or sections discarded by a linker script, we just want the |
| 187 | section contents zeroed. Avoid any special processing. */ |
| 188 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 189 | - contents + rel->r_offset); |
| 190 | + contents, rel->r_offset); |
| 191 | |
| 192 | rel->r_info = 0; |
| 193 | rel->r_addend = 0; |
| 194 | diff --git a/bfd/elf64-ppc.c b/bfd/elf64-ppc.c |
| 195 | index eadde17615..7c3534ac65 100644 |
| 196 | --- a/bfd/elf64-ppc.c |
| 197 | +++ b/bfd/elf64-ppc.c |
| 198 | @@ -14073,7 +14073,7 @@ ppc64_elf_relocate_section (bfd *output_bfd, |
| 199 | { |
| 200 | _bfd_clear_contents (ppc64_elf_howto_table[r_type], |
| 201 | input_bfd, input_section, |
| 202 | - contents + rel->r_offset); |
| 203 | + contents, rel->r_offset); |
| 204 | wrel->r_offset = rel->r_offset; |
| 205 | wrel->r_info = 0; |
| 206 | wrel->r_addend = 0; |
| 207 | diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c |
| 208 | index c3a6c31ed2..4dcab43478 100644 |
| 209 | --- a/bfd/elf64-x86-64.c |
| 210 | +++ b/bfd/elf64-x86-64.c |
| 211 | @@ -2490,7 +2490,7 @@ elf_x86_64_relocate_section (bfd *output_bfd, |
| 212 | if (sec != NULL && discarded_section (sec)) |
| 213 | { |
| 214 | _bfd_clear_contents (howto, input_bfd, input_section, |
| 215 | - contents + rel->r_offset); |
| 216 | + contents, rel->r_offset); |
| 217 | wrel->r_offset = rel->r_offset; |
| 218 | wrel->r_info = 0; |
| 219 | wrel->r_addend = 0; |
| 220 | diff --git a/bfd/libbfd-in.h b/bfd/libbfd-in.h |
| 221 | index e53b255dad..f6d9565f03 100644 |
| 222 | --- a/bfd/libbfd-in.h |
| 223 | +++ b/bfd/libbfd-in.h |
| 224 | @@ -696,8 +696,8 @@ extern bfd_reloc_status_type _bfd_relocate_contents |
| 225 | (reloc_howto_type *, bfd *, bfd_vma, bfd_byte *) ATTRIBUTE_HIDDEN; |
| 226 | |
| 227 | /* Clear a given location using a given howto. */ |
| 228 | -extern void _bfd_clear_contents |
| 229 | - (reloc_howto_type *, bfd *, asection *, bfd_byte *) ATTRIBUTE_HIDDEN; |
| 230 | +extern bfd_reloc_status_type _bfd_clear_contents |
| 231 | + (reloc_howto_type *, bfd *, asection *, bfd_byte *, bfd_vma) ATTRIBUTE_HIDDEN; |
| 232 | |
| 233 | /* Link stabs in sections in the first pass. */ |
| 234 | |
| 235 | diff --git a/bfd/libbfd.h b/bfd/libbfd.h |
| 236 | index a8851c8026..1189e63358 100644 |
| 237 | --- a/bfd/libbfd.h |
| 238 | +++ b/bfd/libbfd.h |
| 239 | @@ -701,8 +701,8 @@ extern bfd_reloc_status_type _bfd_relocate_contents |
| 240 | (reloc_howto_type *, bfd *, bfd_vma, bfd_byte *) ATTRIBUTE_HIDDEN; |
| 241 | |
| 242 | /* Clear a given location using a given howto. */ |
| 243 | -extern void _bfd_clear_contents |
| 244 | - (reloc_howto_type *, bfd *, asection *, bfd_byte *) ATTRIBUTE_HIDDEN; |
| 245 | +extern bfd_reloc_status_type _bfd_clear_contents |
| 246 | + (reloc_howto_type *, bfd *, asection *, bfd_byte *, bfd_vma) ATTRIBUTE_HIDDEN; |
| 247 | |
| 248 | /* Link stabs in sections in the first pass. */ |
| 249 | |
| 250 | diff --git a/bfd/reloc.c b/bfd/reloc.c |
| 251 | index 8dbb8896d3..1686780669 100644 |
| 252 | --- a/bfd/reloc.c |
| 253 | +++ b/bfd/reloc.c |
| 254 | @@ -1613,16 +1613,22 @@ _bfd_relocate_contents (reloc_howto_type *howto, |
| 255 | relocations against discarded symbols, to make ignorable debug or unwind |
| 256 | information more obvious. */ |
| 257 | |
| 258 | -void |
| 259 | +bfd_reloc_status_type |
| 260 | _bfd_clear_contents (reloc_howto_type *howto, |
| 261 | bfd *input_bfd, |
| 262 | asection *input_section, |
| 263 | - bfd_byte *location) |
| 264 | + bfd_byte *buf, |
| 265 | + bfd_vma off) |
| 266 | { |
| 267 | int size; |
| 268 | bfd_vma x = 0; |
| 269 | + bfd_byte *location; |
| 270 | + |
| 271 | + if (!bfd_reloc_offset_in_range (howto, input_bfd, input_section, off)) |
| 272 | + return bfd_reloc_outofrange; |
| 273 | |
| 274 | /* Get the value we are going to relocate. */ |
| 275 | + location = buf + off; |
| 276 | size = bfd_get_reloc_size (howto); |
| 277 | switch (size) |
| 278 | { |
| 279 | @@ -1687,6 +1693,7 @@ _bfd_clear_contents (reloc_howto_type *howto, |
| 280 | #endif |
| 281 | break; |
| 282 | } |
| 283 | + return bfd_reloc_ok; |
| 284 | } |
| 285 | |
| 286 | /* |
| 287 | @@ -8275,14 +8282,14 @@ bfd_generic_get_relocated_section_contents (bfd *abfd, |
| 288 | |
| 289 | if (symbol->section && discarded_section (symbol->section)) |
| 290 | { |
| 291 | - bfd_byte *p; |
| 292 | + bfd_vma off; |
| 293 | static reloc_howto_type none_howto |
| 294 | = HOWTO (0, 0, 0, 0, FALSE, 0, complain_overflow_dont, NULL, |
| 295 | "unused", FALSE, 0, 0, FALSE); |
| 296 | |
| 297 | - p = data + (*parent)->address * bfd_octets_per_byte (input_bfd); |
| 298 | - _bfd_clear_contents ((*parent)->howto, input_bfd, input_section, |
| 299 | - p); |
| 300 | + off = (*parent)->address * bfd_octets_per_byte (input_bfd); |
| 301 | + _bfd_clear_contents ((*parent)->howto, input_bfd, |
| 302 | + input_section, data, off); |
| 303 | (*parent)->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; |
| 304 | (*parent)->addend = 0; |
| 305 | (*parent)->howto = &none_howto; |
| 306 | -- |
| 307 | 2.13.3 |
| 308 | |