diff options
| author | Alan Modra <amodra@gmail.com> | 2022-10-26 11:26:34 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2022-10-26 15:36:14 +1030 |
| commit | 2f6ba62ed3825afa0d995e23d5bfe2fd8258bd00 (patch) | |
| tree | 344028d5f4d9f4abaf52203384b36f1468d230a8 | |
| parent | 6175be41757e886ce8ef5e792834aced3f5ae397 (diff) | |
| download | binutils-gdb-2f6ba62ed3825afa0d995e23d5bfe2fd8258bd00.tar.gz | |
som.c buffer overflow
Fuzzed object files can put random values in bfd_reloc->address,
leading to large som_reloc_skip output.
* som.c (som_write_fixups): Allow for maximal som_reloc_skip.
| -rw-r--r-- | bfd/som.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/bfd/som.c b/bfd/som.c index 9b0a5513209..b9114e630fe 100644 --- a/bfd/som.c +++ b/bfd/som.c @@ -3005,10 +3005,12 @@ som_write_fixups (bfd *abfd, then dump the current buffer contents now. Also reinitialize the relocation queue. - No single BFD relocation could ever translate into more - than 100 bytes of SOM relocations (20bytes is probably the - upper limit, but leave lots of space for growth). */ - if (p - tmp_space + 100 > SOM_TMP_BUFSIZE) + A single BFD relocation would probably only ever + translate into at most 20 bytes of SOM relocations. + However with fuzzed object files and resulting silly + values for "skip" below, som_reloc_skip can emit 262 + bytes. Leave lots of space for growth. */ + if (p - tmp_space + 512 > SOM_TMP_BUFSIZE) { amt = p - tmp_space; if (bfd_bwrite ((void *) tmp_space, amt, abfd) != amt) |