mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-18 12:24:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

pef: sanity check before malloc

Browse Source 
And do the sanity check in a way that can't overflow.

	* pef.c (bfd_pef_parse_function_stubs): Sanity check header
	imported_library_count and total_imported_symbol_count before
	allocating memory.
This commit is contained in:
Alan Modra 2022-10-29 14:16:29 +10:30
parent c5d4b1b604
commit bb94ac4f95
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
bfd/pef.c
View File

@ -751,6 +751,13 @@ bfd_pef_parse_function_stubs (bfd *abfd,
if (ret < 0) if (ret < 0)
goto error; goto error;
if ((loaderlen - 56) / 24 < header.imported_library_count)
goto error;
if ((loaderlen - 56 - header.imported_library_count * 24) / 4
< header.total_imported_symbol_count)
goto error;
libraries = bfd_malloc libraries = bfd_malloc
(header.imported_library_count * sizeof (bfd_pef_imported_library)); (header.imported_library_count * sizeof (bfd_pef_imported_library));
imports = bfd_malloc imports = bfd_malloc
@ -758,8 +765,6 @@ bfd_pef_parse_function_stubs (bfd *abfd,
if (libraries == NULL || imports == NULL) if (libraries == NULL || imports == NULL)
goto error; goto error;
if (loaderlen < (56 + (header.imported_library_count * 24)))
goto error;
for (i = 0; i < header.imported_library_count; i++) for (i = 0; i < header.imported_library_count; i++)
{ {
ret = bfd_pef_parse_imported_library ret = bfd_pef_parse_imported_library
@ -768,9 +773,6 @@ bfd_pef_parse_function_stubs (bfd *abfd,
goto error; goto error;
} }
if (loaderlen < (56 + (header.imported_library_count * 24)
+ (header.total_imported_symbol_count * 4)))
goto error;
for (i = 0; i < header.total_imported_symbol_count; i++) for (i = 0; i < header.total_imported_symbol_count; i++)
{ {
ret = (bfd_pef_parse_imported_symbol ret = (bfd_pef_parse_imported_symbol