mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-30 12:44:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

bfd_close_all_done bug and bfd_last_cache

Browse Source 
bfd_close ought to always call iovec->bclose so that cache_bclose is
called.  If not, bfd_last_cache will be left pointing at freed memory.
This bug was found by oss-fuzz with the trigger being an old bug in
the ia64-vms support.  Given a file of the "wrong" size,
elf64_vms_close_and_cleanup attempted to extend it, leading to an
error since the file was opened read-only by nm.  nm bad_file bad_file
then hit the use-after-free when opening the second file.

commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and
bfd_close_all_done, but didn't go quite far enough.

	* elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't
	attempt to extend read-only files.
	* opncls.c (bfd_close_all_done): Always call _close_and_cleanup.

An old bug in the ia64-vms support can be used to tickle another bug
in bfd_close_all_done.  If _close_and_cleanup returns an error,
This commit is contained in:
Alan Modra 2023-08-21 18:38:08 +09:30
parent 51939d713f
commit fa62aafb7d
2 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bfd/elf64-ia64-vms.c
View File

@ -4713,7 +4713,8 @@ static bool
elf64_vms_close_and_cleanup (bfd *abfd)
{
bool ret = true;
if (bfd_get_format (abfd) == bfd_object)
if (bfd_get_format (abfd) == bfd_object
&& bfd_write_p (abfd))
{
long isize;

10
bfd/opncls.c
View File

@ -920,13 +920,11 @@ bfd_close_all_done (bfd *abfd)
{
bool ret = BFD_SEND (abfd, _close_and_cleanup, (abfd));
if (ret && abfd->iovec != NULL)
{
ret = abfd->iovec->bclose (abfd) == 0;
if (abfd->iovec != NULL)
ret &= abfd->iovec->bclose (abfd) == 0;
if (ret)
_maybe_make_executable (abfd);
}
if (ret)
_maybe_make_executable (abfd);
_bfd_delete_bfd (abfd);
free (_bfd_error_buf);