| Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame^] | 1 | From 30bcc01478433a1cb05b36dc5c4beef7d2c89b5b Mon Sep 17 00:00:00 2001 |
| 2 | From: Alan Modra <amodra@gmail.com> |
| 3 | Date: Fri, 21 Jun 2019 11:51:38 +0930 |
| 4 | Subject: [PATCH] PR24689, string table corruption |
| 5 | |
| 6 | The testcase in the PR had a e_shstrndx section of type SHT_GROUP. |
| 7 | hdr->contents were initialized by setup_group rather than being read |
| 8 | from the file, thus last byte was not zero and string dereference ran |
| 9 | off the end of the buffer. |
| 10 | |
| 11 | PR 24689 |
| 12 | * elfcode.h (elf_object_p): Check type of e_shstrndx section. |
| 13 | |
| 14 | Upstream-Status: Backport |
| 15 | CVE: CVE-2019-12972 |
| 16 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| 17 | --- |
| 18 | bfd/ChangeLog | 5 +++++ |
| 19 | bfd/elfcode.h | 3 ++- |
| 20 | 2 files changed, 7 insertions(+), 1 deletion(-) |
| 21 | |
| 22 | diff --git a/bfd/ChangeLog b/bfd/ChangeLog |
| 23 | index 91f09e6346..e66fb40a2c 100644 |
| 24 | --- a/bfd/ChangeLog |
| 25 | +++ b/bfd/ChangeLog |
| 26 | @@ -1,3 +1,8 @@ |
| 27 | +2019-06-21 Alan Modra <amodra@gmail.com> |
| 28 | + |
| 29 | + PR 24689 |
| 30 | + * elfcode.h (elf_object_p): Check type of e_shstrndx section. |
| 31 | + |
| 32 | 2019-02-20 Alan Modra <amodra@gmail.com> |
| 33 | |
| 34 | PR 24236 |
| 35 | diff --git a/bfd/elfcode.h b/bfd/elfcode.h |
| 36 | index ec5ea766de..a35a629087 100644 |
| 37 | --- a/bfd/elfcode.h |
| 38 | +++ b/bfd/elfcode.h |
| 39 | @@ -755,7 +755,8 @@ elf_object_p (bfd *abfd) |
| 40 | /* A further sanity check. */ |
| 41 | if (i_ehdrp->e_shnum != 0) |
| 42 | { |
| 43 | - if (i_ehdrp->e_shstrndx >= elf_numsections (abfd)) |
| 44 | + if (i_ehdrp->e_shstrndx >= elf_numsections (abfd) |
| 45 | + || i_shdrp[i_ehdrp->e_shstrndx].sh_type != SHT_STRTAB) |
| 46 | { |
| 47 | /* PR 2257: |
| 48 | We used to just goto got_wrong_format_error here |
| 49 | -- |
| 50 | 2.20.1 |
| 51 | |