This is the mail archive of the
binutils-cvs@sourceware.org
mailing list for the binutils project.
[binutils-gdb] Fix heap-buffer-overflow error detected by address sanitization on a fuzzed binary.
- From: Nick Clifton <nickc at sourceware dot org>
- To: bfd-cvs at sourceware dot org
- Date: 8 Nov 2016 15:04:34 -0000
- Subject: [binutils-gdb] Fix heap-buffer-overflow error detected by address sanitization on a fuzzed binary.
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cb64e50d42a49bce61050c79c5ab0846905b6a82
commit cb64e50d42a49bce61050c79c5ab0846905b6a82
Author: Nick Clifton <nickc@redhat.com>
Date: Tue Nov 8 15:03:46 2016 +0000
Fix heap-buffer-overflow error detected by address sanitization on a fuzzed binary.
PR binutils/20794
* readelf.c (process_section_headers): Fix off-by-one error when
checking for invalid sh_link and sh_info fields.
Diff:
---
binutils/ChangeLog | 6 ++++++
binutils/readelf.c | 8 ++++----
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 09f76b9..d586e03 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2016-11-08 Nick Clifton <nickc@redhat.com>
+
+ PR binutils/20794
+ * readelf.c (process_section_headers): Fix off-by-one error when
+ checking for invalid sh_link and sh_info fields.
+
2016-11-04 Andrew Burgess <andrew.burgess@embecosm.com>
* objcopy.c (copy_section): Add extra calls to free for error
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 114486c..e782e95 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -5978,7 +5978,7 @@ process_section_headers (FILE * file)
case SHT_REL:
case SHT_RELA:
if (section->sh_link < 1
- || section->sh_link > elf_header.e_shnum
+ || section->sh_link >= elf_header.e_shnum
|| (section_headers[section->sh_link].sh_type != SHT_SYMTAB
&& section_headers[section->sh_link].sh_type != SHT_DYNSYM))
warn (_("[%2u]: Link field (%u) should index a symtab section.\n"),
@@ -5992,7 +5992,7 @@ process_section_headers (FILE * file)
case SHT_GNU_verdef:
case SHT_GNU_LIBLIST:
if (section->sh_link < 1
- || section->sh_link > elf_header.e_shnum
+ || section->sh_link >= elf_header.e_shnum
|| section_headers[section->sh_link].sh_type != SHT_STRTAB)
warn (_("[%2u]: Link field (%u) should index a string section.\n"),
i, section->sh_link);
@@ -6025,7 +6025,7 @@ process_section_headers (FILE * file)
case SHT_REL:
case SHT_RELA:
if (section->sh_info < 1
- || section->sh_info > elf_header.e_shnum
+ || section->sh_info >= elf_header.e_shnum
|| (section_headers[section->sh_info].sh_type != SHT_PROGBITS
&& section_headers[section->sh_info].sh_type != SHT_NOBITS
&& section_headers[section->sh_info].sh_type != SHT_NOTE
@@ -6072,7 +6072,7 @@ process_section_headers (FILE * file)
;
else if (section->sh_flags & SHF_INFO_LINK)
{
- if (section->sh_info < 1 || section->sh_info > elf_header.e_shnum)
+ if (section->sh_info < 1 || section->sh_info >= elf_header.e_shnum)
warn (_("[%2u]: Expected link to another section in info field"), i);
}
else if (section->sh_type < SHT_LOOS && section->sh_info != 0)