]> git.ipfire.org Git - thirdparty/binutils-gdb.git/commit - bfd/elf.c
asan: ppc64_elf_get_synthetic_symtab heap buffer overflow
authorAlan Modra <amodra@gmail.com>
Fri, 5 Aug 2022 10:10:23 +0000 (19:40 +0930)
committerAlan Modra <amodra@gmail.com>
Fri, 5 Aug 2022 11:18:29 +0000 (20:48 +0930)
commit37c59664adcb87bdf3279a5919940785057fe565
tree811409b12b93bc339a6cafbf3ae53353cfe08308
parentdfbc689c699b3a15f11e8eb09cb05629f60b36b3
asan: ppc64_elf_get_synthetic_symtab heap buffer overflow

Fuzzed input files with sizes of .dynamic not a multiple of dynamic
tag size can result in reading past the end of the buffer with the
current simple checks.  Fix that, and use the same check in other
files that process input object .dynamic section.  (There is no need
for buffer overflow checks in the linker's generated .dynamic
section.)

* elf32-ppc.c (ppc_elf_get_synthetic_symtab): Sanity check
.dynamic content buffer reads.
* elf64-ppc.c (ppc64_elf_get_synthetic_symtab): Likewise.
* elf64-ia64-vms.c (elf64_vms_link_add_object_symbols): Likewise.
* elf.c (_bfd_elf_print_private_bfd_data): Simplify .dynamic
buffer sanity checks.
* elflink.c (elf_link_add_object_symbols): Avoid possible UB
subtracting sizeof_dyn from pointer.
bfd/elf.c
bfd/elf32-ppc.c
bfd/elf64-ia64-vms.c
bfd/elf64-ppc.c
bfd/elflink.c