mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-03-01 13:26:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

asan: Buffer overflow in som_set_reloc_info

Browse Source 
* som.c (som_set_reloc_info): Add symcount parameter.  Don't
	access symbols past symcount.  Don't access fixup past end_fixups.
	(som_slurp_reloc_table): Adjust som_set_reloc_info calls.
This commit is contained in:
Alan Modra 2022-03-17 16:47:39 +10:30
parent 4c5f3d0c9e
commit 0c6a3cd135
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
bfd/som.c
View File

@ -4939,6 +4939,7 @@ som_set_reloc_info (unsigned char *fixup,
arelent *internal_relocs,
asection *section,
asymbol **symbols,
unsigned int symcount,
bool just_count)
{
unsigned int op, varname, deallocate_contents = 0;
@ -5032,7 +5033,7 @@ som_set_reloc_info (unsigned char *fixup,
else if (ISLOWER (c))
{
int bits = (c - 'a') * 8;
for (v = 0; c > 'a'; --c)
for (v = 0; c > 'a' && fixup < end_fixups; --c)
v = (v << 8) | *fixup++;
if (varname == 'V')
v = sign_extend (v, bits);
@ -5093,7 +5094,7 @@ som_set_reloc_info (unsigned char *fixup,
/* A symbol to use in the relocation. Make a note
of this if we are not just counting. */
case 'S':
if (! just_count)
if (! just_count && (unsigned int) c < symcount)
rptr->sym_ptr_ptr = &symbols[c];
break;
/* Argument relocation bits for a function call. */
@ -5309,7 +5310,7 @@ som_slurp_reloc_table (bfd *abfd,
need it again. */
section->reloc_count = som_set_reloc_info (external_relocs,
fixup_stream_size,
NULL, NULL, NULL, true);
NULL, NULL, NULL, 0, true);
som_section_data (section)->reloc_stream = external_relocs;
}
@ -5335,7 +5336,8 @@ som_slurp_reloc_table (bfd *abfd,
/* Process and internalize the relocations. */
som_set_reloc_info (external_relocs, fixup_stream_size,
internal_relocs, section, symbols, false);
internal_relocs, section, symbols,
bfd_get_symcount (abfd), false);
/* We're done with the external relocations. Free them. */
free (external_relocs);