This is the mail archive of the
binutils-cvs@sourceware.org
mailing list for the binutils project.
[binutils-gdb] Check file size before getting section contents
- From: H.J.Lu <hjl at sourceware dot org>
- To: bfd-cvs at sourceware dot org
- Date: 26 Jun 2017 16:31:00 -0000
- Subject: [binutils-gdb] Check file size before getting section contents
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0630b49c470ca2e3c3f74da4c7e4ff63440dd71f
commit 0630b49c470ca2e3c3f74da4c7e4ff63440dd71f
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Mon Jun 26 09:24:49 2017 -0700
Check file size before getting section contents
Don't check the section size in bfd_get_full_section_contents since
the size of a decompressed section may be larger than the file size.
Instead, check file size in _bfd_generic_get_section_contents.
PR binutils/21665
* compress.c (bfd_get_full_section_contents): Don't check the
file size here.
* libbfd.c (_bfd_generic_get_section_contents): Check for and
reject a section whoes size + offset is greater than the size
of the entire file.
(_bfd_generic_get_section_contents_in_window): Likewise.
Diff:
---
bfd/ChangeLog | 10 +++++++++-
bfd/compress.c | 8 +-------
bfd/libbfd.c | 17 ++++++++++++++++-
3 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index ee926c6..e088cdc 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,4 +1,12 @@
-2017-06-26 Maciej W. Rozycki <macro@imgtec.com>
+2017-06-26 H.J. Lu <hongjiu.lu@intel.com>
+
+ PR binutils/21665
+ * compress.c (bfd_get_full_section_contents): Don't check the
+ file size here.
+ * libbfd.c (_bfd_generic_get_section_contents): Check for and
+ reject a section whoes size + offset is greater than the size
+ of the entire file.
+ (_bfd_generic_get_section_contents_in_window): Likewise.
2017-06-26 Nick Clifton <nickc@redhat.com>
diff --git a/bfd/compress.c b/bfd/compress.c
index 7b2c37c..ef549f9 100644
--- a/bfd/compress.c
+++ b/bfd/compress.c
@@ -239,12 +239,6 @@ bfd_get_full_section_contents (bfd *abfd, sec_ptr sec, bfd_byte **ptr)
*ptr = NULL;
return TRUE;
}
- else if (bfd_get_file_size (abfd) > 0
- && sz > (bfd_size_type) bfd_get_file_size (abfd))
- {
- *ptr = NULL;
- return FALSE;
- }
switch (sec->compress_status)
{
@@ -260,7 +254,7 @@ bfd_get_full_section_contents (bfd *abfd, sec_ptr sec, bfd_byte **ptr)
/* xgettext:c-format */
(_("error: %B(%A) is too large (%#lx bytes)"),
abfd, sec, (long) sz);
- return FALSE;
+ return FALSE;
}
}
diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index 554234f..b903328 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -789,6 +789,7 @@ _bfd_generic_get_section_contents (bfd *abfd,
bfd_size_type count)
{
bfd_size_type sz;
+ file_ptr filesz;
if (count == 0)
return TRUE;
@@ -811,8 +812,15 @@ _bfd_generic_get_section_contents (bfd *abfd,
sz = section->rawsize;
else
sz = section->size;
+ filesz = bfd_get_file_size (abfd);
+ if (filesz < 0)
+ {
+ /* This should never happen. */
+ abort ();
+ }
if (offset + count < count
- || offset + count > sz)
+ || offset + count > sz
+ || (section->filepos + offset + sz) > (bfd_size_type) filesz)
{
bfd_set_error (bfd_error_invalid_operation);
return FALSE;
@@ -835,6 +843,7 @@ _bfd_generic_get_section_contents_in_window
{
#ifdef USE_MMAP
bfd_size_type sz;
+ file_ptr filesz;
if (count == 0)
return TRUE;
@@ -867,7 +876,13 @@ _bfd_generic_get_section_contents_in_window
sz = section->rawsize;
else
sz = section->size;
+ filesz = bfd_get_file_size (abfd);
+ {
+ /* This should never happen. */
+ abort ();
+ }
if (offset + count > sz
+ || (section->filepos + offset + sz) > (bfd_size_type) filesz
|| ! bfd_get_file_window (abfd, section->filepos + offset, count, w,
TRUE))
return FALSE;