Fix memort access problems exposed by fuzzed binaries.

	PR binutils/17531
	* readelf.c (get_unwind_section_word): Skip reloc processing if
	there are no relocs associated with the section.
	(decode_tic6x_unwind_bytecode): Warn and return if the stack
	pointer adjustment falls off the end of the buffer.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index bba4c98220e4e1bea8d7d92e022b1c5380dc5de5..3b82059fa74f3d8aaa0b4de93a8a8a86e41194f5 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,11 @@
+2014-11-18  Nick Clifton  <nickc@redhat.com>
+
+       PR binutils/17531
+       * readelf.c (get_unwind_section_word): Skip reloc processing if
+       there are no relocs associated with the section.
+       (decode_tic6x_unwind_bytecode): Warn and return if the stack
+       pointer adjustment falls off the end of the buffer.
+
 2014-11-14  Nick Clifton  <nickc@redhat.com>
 
        PR binutils/17512

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 964dfc63c71806b9d594dd325dbe5600d61985b0..6cead836a694b36d7360f8246c26db53eae4310f 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -7089,6 +7089,13 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
   /* Get the word at the required offset.  */
   word = byte_get (arm_sec->data + word_offset, 4);
 
+  /* PR 17531: file: id:000001,src:001266+003044,op:splice,rep:128.  */
+  if (arm_sec->rela == NULL)
+    {
+      * wordp = word;
+      return TRUE;
+    }
+
   /* Look through the relocs to find the one that applies to the provided offset.  */
   wrapped = FALSE;
   for (rp = arm_sec->next_rela; rp != arm_sec->rela + arm_sec->nrelas; rp++)
@@ -7583,7 +7590,14 @@ decode_tic6x_unwind_bytecode (struct arm_unw_aux_info *aux,
              if ((buf[i] & 0x80) == 0)
                break;
            }
-         assert (i < sizeof (buf));
+         /* PR 17531: file: id:000001,src:001906+004739,op:splice,rep:2.  */
+         if (i == sizeof (buf))
+           {
+             printf ("<corrupt sp adjust>\n");
+             warn (_("Corrupt stack pointer adjustment detected\n"));
+             return;
+           }
+         
          offset = read_uleb128 (buf, &len, buf + i + 1);
          assert (len == i + 1);
          offset = offset * 8 + 0x408;