]> git.ipfire.org Git - thirdparty/binutils-gdb.git/commit
looping in bfd_mach_o_fat_openr_next_archived_file
authorAlan Modra <amodra@gmail.com>
Wed, 14 Sep 2022 07:27:42 +0000 (16:57 +0930)
committerAlan Modra <amodra@gmail.com>
Wed, 14 Sep 2022 07:44:06 +0000 (17:14 +0930)
commit8d783d5e1d60ec951368ceaf7f4bb8c241e4d3ee
tree42f094fdad88eb14fce2dcb44a73f4f9fb1afa42
parentfaf351b59d95e4bed4d43668498d1ae3d852e0c4
looping in bfd_mach_o_fat_openr_next_archived_file

mach-o.c doesn't sanity check mach-o-fat archives, making it easy for
fuzzers to create an archive with mach_o_fat_archentry headers that
point to the same offset.  bfd_mach_o_fat_openr_next_archived_file
uses the previous element offset to find its header, and thus the next
element.  If two offsets are the same, any tool reading the archive
will get stuck.  This patch rejects such archives, and any with
overlapping elements.

* mach-o.c (overlap_previous): New function.
(bfd_mach_o_fat_archive_p): Sanity check that elements do not
overlap each other or the file and archive headers.
bfd/mach-o.c