diff options
| author | Nick Clifton <nickc@redhat.com> | 2015-02-10 17:53:53 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2015-02-10 17:53:53 +0000 |
| commit | 834f871cdc6e5d9f5bda9ce607fd3c47f41a2ade (patch) | |
| tree | c215907e04d8ef3cac4e7c952d817e38a2383fac /binutils/readelf.c | |
| parent | 03a91817f163986f10cb843f58e2f2cd9186e4f0 (diff) | |
| download | binutils-gdb-834f871cdc6e5d9f5bda9ce607fd3c47f41a2ade.tar.gz | |
Fix memory access violations discovered by running readelf compiled with undefined memory access sanitization on fuzzed binaries.
PR binutils/17531
* dwarf.c (display_debug_pubnames_worker): Use dwarf_vma type for
offset.
* readelf.c (dump_relocations): Handle printing offsets which are
MIN_INT.
(process_corefile_note_segment): Add range check of the namesz
field.
Diffstat (limited to 'binutils/readelf.c')
| -rw-r--r-- | binutils/readelf.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/binutils/readelf.c b/binutils/readelf.c index 00bcb1d4bc2..bc7bd88ad74 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -1611,7 +1611,10 @@ dump_relocations (FILE * file, { bfd_signed_vma off = rels[i].r_addend; - if (off < 0) + /* PR 17531: file: 2e63226f. */ + if (off == ((bfd_signed_vma) 1) << ((sizeof (bfd_signed_vma) * 8) - 1)) + printf (" + %" BFD_VMA_FMT "x", off); + else if (off < 0) printf (" - %" BFD_VMA_FMT "x", - off); else printf (" + %" BFD_VMA_FMT "x", off); @@ -1623,7 +1626,10 @@ dump_relocations (FILE * file, bfd_signed_vma off = rels[i].r_addend; printf ("%*c", is_32bit_elf ? 12 : 20, ' '); - if (off < 0) + /* PR 17531: file: 2e63226f. */ + if (off == ((bfd_signed_vma) 1) << ((sizeof (bfd_signed_vma) * 8) - 1)) + printf ("%" BFD_VMA_FMT "x", off); + else if (off < 0) printf ("-%" BFD_VMA_FMT "x", - off); else printf ("%" BFD_VMA_FMT "x", off); @@ -15065,6 +15071,13 @@ process_corefile_note_segment (FILE * file, bfd_vma offset, bfd_vma length) inote.namedata = external->name; inote.descsz = BYTE_GET (external->descsz); inote.descdata = inote.namedata + align_power (inote.namesz, 2); + /* PR 17531: file: 3443835e. */ + if (inote.descdata < (char *) pnotes) + { + warn (_("Corrupt note: name size is too big: %lx\n"), inote.namesz); + inote.descdata = inote.namedata; + inote.namesz = 0; + } inote.descpos = offset + (inote.descdata - (char *) pnotes); next = inote.descdata + align_power (inote.descsz, 2); } |