Brad Bishop | d5ae7d9 | 2018-06-14 09:52:03 -0700 | [diff] [blame] | 1 | From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001 |
| 2 | From: Alan Modra <amodra@gmail.com> |
| 3 | Date: Sat, 27 Jan 2018 08:19:33 +1030 |
| 4 | Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object |
| 5 | |
| 6 | PR 22741 |
| 7 | * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in |
| 8 | range before converting to a symbol table pointer. |
| 9 | |
| 10 | Upstream-Status: Backport |
| 11 | Affects: Binutils <= 2.30 |
| 12 | CVE: CVE-2018-7208 |
| 13 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 14 | |
| 15 | --- |
| 16 | bfd/ChangeLog | 6 ++++++ |
| 17 | bfd/coffgen.c | 3 ++- |
| 18 | 2 files changed, 8 insertions(+), 1 deletion(-) |
| 19 | |
| 20 | Index: git/bfd/coffgen.c |
| 21 | =================================================================== |
| 22 | --- git.orig/bfd/coffgen.c |
| 23 | +++ git/bfd/coffgen.c |
| 24 | @@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd, |
| 25 | } |
| 26 | /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can |
| 27 | generate one, so we must be careful to ignore it. */ |
| 28 | - if (auxent->u.auxent.x_sym.x_tagndx.l > 0) |
| 29 | + if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l |
| 30 | + < obj_raw_syment_count (abfd)) |
| 31 | { |
| 32 | auxent->u.auxent.x_sym.x_tagndx.p = |
| 33 | table_base + auxent->u.auxent.x_sym.x_tagndx.l; |
| 34 | Index: git/bfd/ChangeLog |
| 35 | =================================================================== |
| 36 | --- git.orig/bfd/ChangeLog |
| 37 | +++ git/bfd/ChangeLog |
| 38 | @@ -1,3 +1,9 @@ |
| 39 | +2018-01-29 Alan Modra <amodra@gmail.com> |
| 40 | + |
| 41 | + PR 22741 |
| 42 | + * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in |
| 43 | + range before converting to a symbol table pointer. |
| 44 | + |
| 45 | 2018-02-28 Alan Modra <amodra@gmail.com> |
| 46 | |
| 47 | PR 22887 |