diff options
| author | Alan Modra <amodra@gmail.com> | 2020-09-04 19:19:18 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2020-09-04 19:29:02 +0930 |
| commit | 8642dafaef21aa6747cec01df1977e9c52eb4679 (patch) | |
| tree | 7674ac87fdb82a435b63f9d60355a901bfebc3b6 /bfd/elf.c | |
| parent | 1e3b96fd6cf0c7d018083994ad951ccf92aba582 (diff) | |
| download | binutils-gdb-8642dafaef21aa6747cec01df1977e9c52eb4679.tar.gz | |
PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_section
A horribly fuzzed object with section headers inside the ELF header.
Disallow that, and crazy reloc sizes.
PR 26574
* elfcode.h (elf_object_p): Sanity check section header offset.
* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
sh_entsize.
Diffstat (limited to 'bfd/elf.c')
| -rw-r--r-- | bfd/elf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/bfd/elf.c b/bfd/elf.c index ac2095f787d..5a02f8dc309 100644 --- a/bfd/elf.c +++ b/bfd/elf.c @@ -12576,7 +12576,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd * abfd, Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr; if (hdr->sh_type == SHT_SECONDARY_RELOC - && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx) + && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx + && (hdr->sh_entsize == ebd->s->sizeof_rel + || hdr->sh_entsize == ebd->s->sizeof_rela)) { bfd_byte * native_relocs; bfd_byte * native_reloc; |