From e3fdc001d359d6bcd033c1276c772e72d3f49078 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 9 Jul 2020 13:18:37 +0930 Subject: asan: readelf: heap buffer overflow in slurp_hppa_unwind_table This one isn't just a weird corner case requiring multiple .PARISC.unwind sections in an object file to trigger the buffer overflow, it's also a simple bug that would prevent relocations being applied in the normal case of a single .PARISC.unwind section. * readelf (slurp_hppa_unwind_table): Set table_len before use in relocation sanity checks. --- binutils/readelf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'binutils/readelf.c') diff --git a/binutils/readelf.c b/binutils/readelf.c index 41547a2594b..0feeed9831d 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -8253,6 +8253,7 @@ slurp_hppa_unwind_table (Filedata * filedata, nentries = size / unw_ent_size; size = unw_ent_size * nentries; + aux->table_len = nentries; tep = aux->table = (struct hppa_unw_table_entry *) xcmalloc (nentries, sizeof (aux->table[0])); @@ -8372,8 +8373,6 @@ slurp_hppa_unwind_table (Filedata * filedata, free (rela); } - aux->table_len = nentries; - return TRUE; } -- cgit v1.2.1