mirrors/binutils-gdb
0
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-12-04 15:54:25 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

asan: _bfd_pei_slurp_codeview_record use of uninit value

Browse Source 
Fixes some seriously careless code.  bfd_bread return value is
(bfd_size_type)-1 on error.  "if (bfd_bread (...) < 4)" does not check
for an error since bfd_size_type is unsigned.  In any case, I think we
should be reading and checking the requested length.

	* peXXigen.c (_bfd_XXi_slurp_codeview_record): Properly check
	return value of bfd_bread.  Don't read more than requested length.
	Sanity check length.  Properly terminate file name.
This commit is contained in:
Alan Modra 2020-06-29 09:51:07 +09:30
parent 279edac53d
commit 07d22f648e
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2020-06-29 Alan Modra <amodra@gmail.com>
* peXXigen.c (_bfd_XXi_slurp_codeview_record): Properly check
return value of bfd_bread. Don't read more than requested length.
Sanity check length. Properly terminate file name.
2020-06-29 Alan Modra <amodra@gmail.com> 2020-06-29 Alan Modra <amodra@gmail.com>
* arc-got.h: Use C style comments. * arc-got.h: Use C style comments.

10
bfd/peXXigen.c
View File

@ -1147,15 +1147,21 @@ CODEVIEW_INFO *
_bfd_XXi_slurp_codeview_record (bfd * abfd, file_ptr where, unsigned long length, CODEVIEW_INFO *cvinfo) _bfd_XXi_slurp_codeview_record (bfd * abfd, file_ptr where, unsigned long length, CODEVIEW_INFO *cvinfo)
{ {
char buffer[256+1]; char buffer[256+1];
bfd_size_type nread;
if (bfd_seek (abfd, where, SEEK_SET) != 0) if (bfd_seek (abfd, where, SEEK_SET) != 0)
return NULL; return NULL;
if (bfd_bread (buffer, 256, abfd) < 4) if (length <= sizeof (CV_INFO_PDB70) && length <= sizeof (CV_INFO_PDB20))
return NULL;
if (length > 256)
length = 256;
nread = bfd_bread (buffer, length, abfd);
if (length != nread)
return NULL; return NULL;
/* Ensure null termination of filename. */ /* Ensure null termination of filename. */
buffer[256] = '\0'; memset (buffer + nread, 0, sizeof (buffer) - nread);
cvinfo->CVSignature = H_GET_32 (abfd, buffer); cvinfo->CVSignature = H_GET_32 (abfd, buffer);
cvinfo->Age = 0; cvinfo->Age = 0;