From: Alan Modra <amodra@gmail.com>
Date: Sat, 4 May 2024 09:45:49 +0000 (+0930)
Subject: bus error with fuzzed archive element
X-Git-Tag: gdb-15-branchpoint~184
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c7a1fe2286e6f68c8bd0cef12feca4ade2451a25;p=thirdparty%2Fbinutils-gdb.git

bus error with fuzzed archive element

	* libbfd.c (bfd_mmap_local): Sanity check rsize against actual
	file offset and size, not an archive element offset and size.
---

diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index 747b69ec2c6..53868471001 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -1072,7 +1072,18 @@ static void *
 bfd_mmap_local (bfd *abfd, size_t rsize, int prot, void **map_addr,
 		size_t *map_size)
 {
-  ufile_ptr filesize = bfd_get_file_size (abfd);
+  /* We mmap on the underlying file.  In an archive it might be nice
+     to limit RSIZE to the element size, but that can be fuzzed and
+     the offset returned by bfd_tell is relative to the start of the
+     element.  Therefore to reliably stop access beyond the end of a
+     file (and resulting bus errors) we must work with the underlying
+     file offset and size, and trust that callers will limit access to
+     within an archive element.  */
+  while (abfd->my_archive != NULL
+	 && !bfd_is_thin_archive (abfd->my_archive))
+    abfd = abfd->my_archive;
+
+  ufile_ptr filesize = bfd_get_size (abfd);
   ufile_ptr offset = bfd_tell (abfd);
   if (filesize < offset || filesize - offset < rsize)
     {