Brad Bishop | d5ae7d9 | 2018-06-14 09:52:03 -0700 | [diff] [blame] | 1 | From eef104664efb52965d85a28bc3fc7c77e52e48e2 Mon Sep 17 00:00:00 2001 |
| 2 | From: Nick Clifton <nickc@redhat.com> |
| 3 | Date: Wed, 28 Feb 2018 10:13:54 +0000 |
| 4 | Subject: [PATCH] Fix potential integer overflow when reading corrupt dwarf1 |
| 5 | debug information. |
| 6 | |
| 7 | PR 22894 |
| 8 | * dwarf1.c (parse_die): Check the length of form blocks before |
| 9 | advancing the data pointer. |
| 10 | |
| 11 | Upstream-Status: Backport |
| 12 | Affects: Binutils <= 2.30 |
| 13 | CVE: CVE-2018-7568 |
| 14 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 15 | |
| 16 | --- |
| 17 | bfd/ChangeLog | 6 ++++++ |
| 18 | bfd/dwarf1.c | 17 +++++++++++++++-- |
| 19 | 2 files changed, 21 insertions(+), 2 deletions(-) |
| 20 | |
| 21 | Index: git/bfd/dwarf1.c |
| 22 | =================================================================== |
| 23 | --- git.orig/bfd/dwarf1.c |
| 24 | +++ git/bfd/dwarf1.c |
| 25 | @@ -213,6 +213,7 @@ parse_die (bfd * abfd, |
| 26 | /* Then the attributes. */ |
| 27 | while (xptr + 2 <= aDiePtrEnd) |
| 28 | { |
| 29 | + unsigned int block_len; |
| 30 | unsigned short attr; |
| 31 | |
| 32 | /* Parse the attribute based on its form. This section |
| 33 | @@ -255,12 +256,24 @@ parse_die (bfd * abfd, |
| 34 | break; |
| 35 | case FORM_BLOCK2: |
| 36 | if (xptr + 2 <= aDiePtrEnd) |
| 37 | - xptr += bfd_get_16 (abfd, xptr); |
| 38 | + { |
| 39 | + block_len = bfd_get_16 (abfd, xptr); |
| 40 | + if (xptr + block_len > aDiePtrEnd |
| 41 | + || xptr + block_len < xptr) |
| 42 | + return FALSE; |
| 43 | + xptr += block_len; |
| 44 | + } |
| 45 | xptr += 2; |
| 46 | break; |
| 47 | case FORM_BLOCK4: |
| 48 | if (xptr + 4 <= aDiePtrEnd) |
| 49 | - xptr += bfd_get_32 (abfd, xptr); |
| 50 | + { |
| 51 | + block_len = bfd_get_32 (abfd, xptr); |
| 52 | + if (xptr + block_len > aDiePtrEnd |
| 53 | + || xptr + block_len < xptr) |
| 54 | + return FALSE; |
| 55 | + xptr += block_len; |
| 56 | + } |
| 57 | xptr += 4; |
| 58 | break; |
| 59 | case FORM_STRING: |
| 60 | Index: git/bfd/ChangeLog |
| 61 | =================================================================== |
| 62 | --- git.orig/bfd/ChangeLog |
| 63 | +++ git/bfd/ChangeLog |
| 64 | @@ -4,7 +4,11 @@ |
| 65 | * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in |
| 66 | range before converting to a symbol table pointer. |
| 67 | |
| 68 | -2018-02-28 Alan Modra <amodra@gmail.com> |
| 69 | +2018-02-28 Nick Clifton <nickc@redhat.com> |
| 70 | + |
| 71 | + PR 22894 |
| 72 | + * dwarf1.c (parse_die): Check the length of form blocks before |
| 73 | + advancing the data pointer. |
| 74 | |
| 75 | PR 22895 |
| 76 | PR 22893 |
| 77 | @@ -14,6 +18,8 @@ |
| 78 | size is invalid. |
| 79 | (read_attribute_value): Adjust invocations of read_n_bytes. |
| 80 | |
| 81 | +2018-02-28 Alan Modra <amodra@gmail.com> |
| 82 | + |
| 83 | PR 22887 |
| 84 | * aoutx.h (swap_std_reloc_in): Correct r_index bound check. |
| 85 | |