| Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 1 | From 39ff1b79f687b65f4144ddb379f22587003443fb Mon Sep 17 00:00:00 2001 |
| 2 | From: Nick Clifton <nickc@redhat.com> |
| 3 | Date: Tue, 2 May 2017 11:54:53 +0100 |
| 4 | Subject: [PATCH] Prevent memory exhaustion from a corrupt PE binary with an |
| 5 | overlarge number of relocs. |
| 6 | |
| 7 | PR 21440 |
| 8 | * objdump.c (dump_relocs_in_section): Check for an excessive |
| 9 | number of relocs before attempting to dump them. |
| 10 | |
| 11 | Upstream-Status: Backport |
| 12 | CVE: CVE-2017-8421 |
| 13 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 14 | |
| 15 | --- |
| 16 | binutils/ChangeLog | 6 ++++++ |
| 17 | binutils/objdump.c | 8 ++++++++ |
| 18 | 2 files changed, 14 insertions(+) |
| 19 | |
| 20 | Index: git/binutils/objdump.c |
| 21 | =================================================================== |
| 22 | --- git.orig/binutils/objdump.c |
| 23 | +++ git/binutils/objdump.c |
| 24 | @@ -3311,6 +3311,14 @@ dump_relocs_in_section (bfd *abfd, |
| 25 | return; |
| 26 | } |
| 27 | |
| 28 | + if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0 |
| 29 | + && relsize > get_file_size (bfd_get_filename (abfd))) |
| 30 | + { |
| 31 | + printf (" (too many: 0x%x)\n", section->reloc_count); |
| 32 | + bfd_set_error (bfd_error_file_truncated); |
| 33 | + bfd_fatal (bfd_get_filename (abfd)); |
| 34 | + } |
| 35 | + |
| 36 | relpp = (arelent **) xmalloc (relsize); |
| 37 | relcount = bfd_canonicalize_reloc (abfd, section, relpp, syms); |
| 38 | |
| 39 | Index: git/binutils/ChangeLog |
| 40 | =================================================================== |
| 41 | --- git.orig/binutils/ChangeLog |
| 42 | +++ git/binutils/ChangeLog |
| 43 | @@ -1,3 +1,9 @@ |
| 44 | +2017-05-02 Nick Clifton <nickc@redhat.com> |
| 45 | + |
| 46 | + PR 21440 |
| 47 | + * objdump.c (dump_relocs_in_section): Check for an excessive |
| 48 | + number of relocs before attempting to dump them. |
| 49 | + |
| 50 | 2017-04-28 Nick Clifton <nickc@redhat.com> |
| 51 | |
| 52 | PR binutils/21438 |