mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-11-27 03:51:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

bus error with fuzzed archive element

Browse Source 
* libbfd.c (bfd_mmap_local): Sanity check rsize against actual
	file offset and size, not an archive element offset and size.
This commit is contained in:
Alan Modra 2024-05-04 19:15:49 +09:30
parent c479e964a8
commit c7a1fe2286
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
bfd/libbfd.c
View File

@ -1072,7 +1072,18 @@ static void *
bfd_mmap_local (bfd *abfd, size_t rsize, int prot, void **map_addr,
size_t *map_size)
{
ufile_ptr filesize = bfd_get_file_size (abfd);
/* We mmap on the underlying file. In an archive it might be nice
to limit RSIZE to the element size, but that can be fuzzed and
the offset returned by bfd_tell is relative to the start of the
element. Therefore to reliably stop access beyond the end of a
file (and resulting bus errors) we must work with the underlying
file offset and size, and trust that callers will limit access to
within an archive element. */
while (abfd->my_archive != NULL
&& !bfd_is_thin_archive (abfd->my_archive))
abfd = abfd->my_archive;
ufile_ptr filesize = bfd_get_size (abfd);
ufile_ptr offset = bfd_tell (abfd);
if (filesize < offset || filesize - offset < rsize)
{