MatCat.OpenSource/8sa1-binutils-gdb
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Re: vms buffer overflows and large memory allocation

Browse Source 
The last patch wasn't quite correct.  I'd missed the fact that sbm_off
had been updated.

	* vms-lib.c (_bfd_vms_lib_archive_p): Correct overflow checks.
This commit is contained in:
Alan Modra 2020-02-24 13:19:13 +10:30
parent c893ce360a
commit a98c743fdf
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bfd/ChangeLog
View File

@ -1,3 +1,7 @@
2020-02-24 Alan Modra <amodra@gmail.com>
* vms-lib.c (_bfd_vms_lib_archive_p): Correct overflow checks.
2020-02-24 Alan Modra <amodra@gmail.com> 2020-02-24 Alan Modra <amodra@gmail.com>
* vms-lib.c (struct carsym_mem): Add limit. * vms-lib.c (struct carsym_mem): Add limit.

14
bfd/vms-lib.c
View File

@ -627,6 +627,8 @@ _bfd_vms_lib_archive_p (bfd *abfd, enum vms_lib_kind kind)
sbm = (struct vms_dcxsbm *) (buf + sbm_off); sbm = (struct vms_dcxsbm *) (buf + sbm_off);
sbm_sz = bfd_getl16 (sbm->size); sbm_sz = bfd_getl16 (sbm->size);
sbm_off += sbm_sz; sbm_off += sbm_sz;
if (sbm_off > reclen)
goto err;
sbmdesc->min_char = sbm->min_char; sbmdesc->min_char = sbm->min_char;
BFD_ASSERT (sbmdesc->min_char == 0); BFD_ASSERT (sbmdesc->min_char == 0);
@ -639,21 +641,21 @@ _bfd_vms_lib_archive_p (bfd *abfd, enum vms_lib_kind kind)
goto err; goto err;
sbmdesc->flags = (unsigned char *)bfd_alloc (abfd, l); sbmdesc->flags = (unsigned char *)bfd_alloc (abfd, l);
off = bfd_getl16 (sbm->flags); off = bfd_getl16 (sbm->flags);
if (off > reclen - sbm_off if (off > sbm_sz
|| reclen - sbm_off - off < l) || sbm_sz - off < l)
goto err; goto err;
memcpy (sbmdesc->flags, (bfd_byte *) sbm + off, l); memcpy (sbmdesc->flags, (bfd_byte *) sbm + off, l);
sbmdesc->nodes = (unsigned char *)bfd_alloc (abfd, 2 * sbm_len); sbmdesc->nodes = (unsigned char *)bfd_alloc (abfd, 2 * sbm_len);
off = bfd_getl16 (sbm->nodes); off = bfd_getl16 (sbm->nodes);
if (off > reclen - sbm_off if (off > sbm_sz
|| reclen - sbm_off - off < 2 * sbm_len) || sbm_sz - off < 2 * sbm_len)
goto err; goto err;
memcpy (sbmdesc->nodes, (bfd_byte *) sbm + off, 2 * sbm_len); memcpy (sbmdesc->nodes, (bfd_byte *) sbm + off, 2 * sbm_len);
off = bfd_getl16 (sbm->next); off = bfd_getl16 (sbm->next);
if (off != 0) if (off != 0)
{ {
if (off > reclen - sbm_off if (off > sbm_sz
|| reclen - sbm_off - off < 2 * sbm_len) || sbm_sz - off < 2 * sbm_len)
goto err; goto err;
/* Read the 'next' array. */ /* Read the 'next' array. */
sbmdesc->next = (unsigned short *) bfd_alloc (abfd, 2 * sbm_len); sbmdesc->next = (unsigned short *) bfd_alloc (abfd, 2 * sbm_len);