asan: buffer overflow in elf32_arm_get_synthetic_symtab

[thirdparty/binutils-gdb.git] / bfd / elf32-arm.c

diff --git a/bfd/elf32-arm.c b/bfd/elf32-arm.c
index 2afe67abdf10ba6bc484cbedd2b5ad6d6c433381..18c30dbef866c6804b2b7b9c623e43d64df40724 100644 (file)
--- a/bfd/elf32-arm.c
+++ b/bfd/elf32-arm.c
@@ -14119,7 +14119,7 @@ set_secondary_compatible_arch (bfd *abfd, int arch)
 
 static int
 tag_cpu_arch_combine (bfd *ibfd, int oldtag, int *secondary_compat_out,
-                     int newtag, int secondary_compat)
+                     int newtag, int secondary_compat, const char* name_table[])
 {
 #define T(X) TAG_CPU_ARCH_##X
   int tagl, tagh, result;
@@ -14436,8 +14436,8 @@ tag_cpu_arch_combine (bfd *ibfd, int oldtag, int *secondary_compat_out,
 
   if (result == -1)
     {
-      _bfd_error_handler (_("error: %pB: conflicting CPU architectures %d/%d"),
-                         ibfd, oldtag, newtag);
+      _bfd_error_handler (_("error: conflicting CPU architectures %s vs %s in %pB"),
+                         name_table[oldtag], name_table[newtag], ibfd);
       return -1;
     }
 
@@ -14632,7 +14632,8 @@ elf32_arm_merge_eabi_attributes (bfd *ibfd, struct bfd_link_info *info)
            arch_attr = tag_cpu_arch_combine (ibfd, out_attr[i].i,
                                              &secondary_compat_out,
                                              in_attr[i].i,
-                                             secondary_compat);
+                                             secondary_compat,
+                                             name_table);
 
            /* Return with error if failed to merge.  */
            if (arch_attr == -1)
@@ -19970,11 +19971,15 @@ read_code16 (const bfd *abfd, const bfd_byte *addr)
    or (bfd_vma) -1 if size can not be determined.  */
 
 static bfd_vma
-elf32_arm_plt0_size (const bfd *abfd, const bfd_byte *addr)
+elf32_arm_plt0_size (const bfd *abfd, const bfd_byte *addr,
+                    bfd_size_type data_size)
 {
   bfd_vma first_word;
   bfd_vma plt0_size;
 
+  if (data_size < 4)
+    return (bfd_vma) -1;
+
   first_word = read_code32 (abfd, addr);
 
   if (first_word == elf32_arm_plt0_entry[0])
@@ -19993,24 +19998,28 @@ elf32_arm_plt0_size (const bfd *abfd, const bfd_byte *addr)
    or (bfd_vma) -1 if size can not be determined.  */
 
 static bfd_vma
-elf32_arm_plt_size (const bfd *abfd, const bfd_byte *start, bfd_vma offset)
+elf32_arm_plt_size (const bfd *abfd, const bfd_byte *start, bfd_vma offset,
+                   bfd_size_type data_size)
 {
   bfd_vma first_insn;
   bfd_vma plt_size = 0;
-  const bfd_byte *addr = start + offset;
 
   /* PLT entry size if fixed on Thumb-only platforms.  */
   if (read_code32 (abfd, start) == elf32_thumb2_plt0_entry[0])
-      return 4 * ARRAY_SIZE (elf32_thumb2_plt_entry);
+    return 4 * ARRAY_SIZE (elf32_thumb2_plt_entry);
 
   /* Respect Thumb stub if necessary.  */
-  if (read_code16 (abfd, addr) == elf32_arm_plt_thumb_stub[0])
+  if (offset + 2 > data_size)
+    return (bfd_vma) -1;
+  if (read_code16 (abfd, start + offset) == elf32_arm_plt_thumb_stub[0])
     {
       plt_size += 2 * ARRAY_SIZE (elf32_arm_plt_thumb_stub);
     }
 
   /* Strip immediate from first add.  */
-  first_insn = read_code32 (abfd, addr + plt_size) & 0xffffff00;
+  if (offset + plt_size + 4 > data_size)
+    return (bfd_vma) -1;
+  first_insn = read_code32 (abfd, start + offset + plt_size) & 0xffffff00;
 
 #ifdef FOUR_WORD_PLT
   if (first_insn == elf32_arm_plt_entry[0])
@@ -20073,15 +20082,9 @@ elf32_arm_get_synthetic_symtab (bfd *abfd,
   if (!elf32_arm_size_info.slurp_reloc_table (abfd, relplt, dynsyms, true))
     return -1;
 
-  data = plt->contents;
-  if (data == NULL)
-    {
-      if (!bfd_get_full_section_contents (abfd, plt, &data)
-         || data == NULL)
-       return -1;
-      plt->contents = data;
-      plt->flags |= SEC_IN_MEMORY;
-    }
+  data = NULL;
+  if (!bfd_get_full_section_contents (abfd, plt, &data))
+    return -1;
 
   count = NUM_SHDR_ENTRIES (hdr);
   size = count * sizeof (asymbol);
@@ -20093,13 +20096,13 @@ elf32_arm_get_synthetic_symtab (bfd *abfd,
        size += sizeof ("+0x") - 1 + 8;
     }
 
-  s = *ret = (asymbol *) bfd_malloc (size);
-  if (s == NULL)
-    return -1;
-
-  offset = elf32_arm_plt0_size (abfd, data);
-  if (offset == (bfd_vma) -1)
-    return -1;
+  offset = elf32_arm_plt0_size (abfd, data, plt->size);
+  if (offset == (bfd_vma) -1
+      || (s = *ret = (asymbol *) bfd_malloc (size)) == NULL)
+    {
+      free (data);
+      return -1;
+    }
 
   names = (char *) (s + count);
   p = relplt->relocation;
@@ -20108,7 +20111,7 @@ elf32_arm_get_synthetic_symtab (bfd *abfd,
     {
       size_t len;
 
-      bfd_vma plt_size = elf32_arm_plt_size (abfd, data, offset);
+      bfd_vma plt_size = elf32_arm_plt_size (abfd, data, offset, plt->size);
       if (plt_size == (bfd_vma) -1)
        break;
 
@@ -20144,6 +20147,7 @@ elf32_arm_get_synthetic_symtab (bfd *abfd,
       offset += plt_size;
     }
 
+  free (data);
   return n;
 }