Re: [PATCH] PR binutils/19005: objcopy buffer-over-read

["H.J. Lu" <hjl dot tools at gmail dot com>]

On Mon, Sep 28, 2015 at 4:54 PM, H.J. Lu <hongjiu.lu@intel.com> wrote:
> On Mon, Sep 28, 2015 at 02:25:02PM -0700, H.J. Lu wrote:
>> In objcopy, copy_object calls copy_section to copy contents of input
>> section to output section.  When --gap-fill= is used, objcopy extends
>> the size of output sectios to faill gaps between output sections with
>> gap fills.  In this case, we should set the output section size to the
>> input section size to avoid reading beypond the input section buffer
>> before calling copy_section and restores the output section size after
>> input sections have been copied.
>>
>> OK for master?
>>
>
> A simpler patch.
>
>
> H.J.
> --
> In objcopy, copy_object calls copy_section to copy contents of input
> section to output section.  When --gap-fill= is used, objcopy extends
> the size of output sectios to fill gaps between output sections with
> gap fills.  In this case, we should set the output section size to the
> input section size to avoid reading beypond the input section buffer
> before calling copy_section and restores the output section size after
> input sections have been copied.
>
> binutils/
>
>         PR binutils/19005
>         * objcopy.c (copy_object): Adjust the output section size to
>         skip gap fills between sections when copying from input sections
>         to output sections.
>
> ld/testsuite/
>
>         PR binutils/19005
>         * ld-elf/pr19005.d: New file.
>         * ld-elf/pr19005.s: Likewise.
>         * ld-elf/pr19005.t: Likewise.

I checked in this.


-- 
H.J.