This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
PR22741, objcopy segfault on fuzzed COFF object
- From: Alan Modra <amodra at gmail dot com>
- To: binutils at sourceware dot org
- Date: Mon, 29 Jan 2018 15:59:20 +1030
- Subject: PR22741, objcopy segfault on fuzzed COFF object
- Authentication-results: sourceware.org; auth=none
Applying. auxent tagndx is supposed to be a symbol table index.
PR 22741
* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
range before converting to a symbol table pointer.
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b241087..4f90ead 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
}
/* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
generate one, so we must be careful to ignore it. */
- if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+ if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+ < obj_raw_syment_count (abfd))
{
auxent->u.auxent.x_sym.x_tagndx.p =
table_base + auxent->u.auxent.x_sym.x_tagndx.l;
--
Alan Modra
Australia Development Lab, IBM