X-Git-Url: http://git.efficios.com/?a=blobdiff_plain;f=bfd%2Fpei-x86_64.c;h=c0b97351defb044a4498fc70908ed89dfc83526e;hb=95655446a6f136b654fa5fe1ff6fa2b7466a3545;hp=db307266c83b99cb777a010e72d7c1ddd5d3016a;hpb=219d1afa89d0d53ca93a684cac341f16470f3ca0;p=deliverable%2Fbinutils-gdb.git diff --git a/bfd/pei-x86_64.c b/bfd/pei-x86_64.c index db307266c8..c0b97351de 100644 --- a/bfd/pei-x86_64.c +++ b/bfd/pei-x86_64.c @@ -1,5 +1,5 @@ /* BFD back-end for Intel 386 PE IMAGE COFF files. - Copyright (C) 2006-2018 Free Software Foundation, Inc. + Copyright (C) 2006-2019 Free Software Foundation, Inc. This file is part of BFD, the Binary File Descriptor library. @@ -98,14 +98,20 @@ pex64_get_runtime_function (bfd *abfd, struct pex64_runtime_function *rf, /* Swap in unwind info header. */ -static void -pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui, void *data) +static bfd_boolean +pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui, + void *data, void *data_end) { struct external_pex64_unwind_info *ex_ui = (struct external_pex64_unwind_info *) data; bfd_byte *ex_dta = (bfd_byte *) data; + bfd_byte *ex_dta_end = (bfd_byte *) data_end; memset (ui, 0, sizeof (struct pex64_unwind_info)); + + if (ex_dta >= ex_dta_end || ex_dta + 4 >= ex_dta_end) + return FALSE; + ui->Version = PEX64_UWI_VERSION (ex_ui->Version_Flags); ui->Flags = PEX64_UWI_FLAGS (ex_ui->Version_Flags); ui->SizeOfPrologue = (bfd_vma) ex_ui->SizeOfPrologue; @@ -114,25 +120,33 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui, void *data) ui->FrameOffset = PEX64_UWI_FRAMEOFF (ex_ui->FrameRegisterOffset); ui->sizeofUnwindCodes = PEX64_UWI_SIZEOF_UWCODE_ARRAY (ui->CountOfCodes); ui->SizeOfBlock = ui->sizeofUnwindCodes + 4; - ui->rawUnwindCodes = &ex_dta[4]; + ui->rawUnwindCodes = ex_dta + 4; + ui->rawUnwindCodesEnd = ex_dta_end; ex_dta += ui->SizeOfBlock; + if (ex_dta >= ex_dta_end) + return FALSE; + switch (ui->Flags) { case UNW_FLAG_CHAININFO: + if (ex_dta + 12 >= ex_dta_end) + return FALSE; ui->rva_BeginAddress = bfd_get_32 (abfd, ex_dta + 0); ui->rva_EndAddress = bfd_get_32 (abfd, ex_dta + 4); ui->rva_UnwindData = bfd_get_32 (abfd, ex_dta + 8); ui->SizeOfBlock += 12; - return; + return TRUE; case UNW_FLAG_EHANDLER: case UNW_FLAG_UHANDLER: case UNW_FLAG_FHANDLER: + if (ex_dta + 4 >= ex_dta_end) + return FALSE; ui->rva_ExceptionHandler = bfd_get_32 (abfd, ex_dta); ui->SizeOfBlock += 4; - return; + return TRUE; default: - return; + return TRUE; } } @@ -158,6 +172,12 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, i = 0; + if (ui->rawUnwindCodes + 1 >= ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + if (ui->Version == 2 && PEX64_UNWCODE_CODE (ui->rawUnwindCodes[1]) == UWOP_EPILOG) { @@ -166,10 +186,18 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, to decode instruction flow if outside an epilog. */ unsigned int func_size = rf->rva_EndAddress - rf->rva_BeginAddress; + if (ui->rawUnwindCodes + 1 + (ui->CountOfCodes * 2) >= ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + fprintf (file, "\tv2 epilog (length: %02x) at pc+:", ui->rawUnwindCodes[0]); + if (PEX64_UNWCODE_INFO (ui->rawUnwindCodes[1])) fprintf (file, " 0x%x", func_size - ui->rawUnwindCodes[0]); + i++; for (; i < ui->CountOfCodes; i++) { @@ -187,6 +215,12 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, fputc ('\n', file); } + if (ui->rawUnwindCodes + 2 + (ui->CountOfCodes * 2) >= ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + for (; i < ui->CountOfCodes; i++) { const bfd_byte *dta = ui->rawUnwindCodes + 2 * i; @@ -194,27 +228,41 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, int unexpected = FALSE; fprintf (file, "\t pc+0x%02x: ", (unsigned int) dta[0]); + switch (PEX64_UNWCODE_CODE (dta[1])) { case UWOP_PUSH_NONVOL: fprintf (file, "push %s", pex_regs[info]); break; + case UWOP_ALLOC_LARGE: if (info == 0) { - tmp = bfd_get_16 (abfd, &dta[2]) * 8; + if (dta + 4 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_16 (abfd, dta + 2) * 8; i++; } else { - tmp = bfd_get_32 (abfd, &dta[2]); + if (dta + 6 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_32 (abfd, dta + 2); i += 2; } fprintf (file, "alloc large area: rsp = rsp - 0x%x", tmp); break; + case UWOP_ALLOC_SMALL: fprintf (file, "alloc small area: rsp = rsp - 0x%x", (info + 1) * 8); break; + case UWOP_SET_FPREG: /* According to the documentation, info field is unused. */ fprintf (file, "FPReg: %s = rsp + 0x%x (info = 0x%x)", @@ -223,22 +271,40 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, unexpected = ui->FrameRegister == 0; save_allowed = FALSE; break; + case UWOP_SAVE_NONVOL: - tmp = bfd_get_16 (abfd, &dta[2]) * 8; + if (dta + 4 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_16 (abfd, dta + 2) * 8; i++; fprintf (file, "save %s at rsp + 0x%x", pex_regs[info], tmp); unexpected = !save_allowed; break; + case UWOP_SAVE_NONVOL_FAR: - tmp = bfd_get_32 (abfd, &dta[2]); + if (dta + 6 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_32 (abfd, dta + 2); i += 2; fprintf (file, "save %s at rsp + 0x%x", pex_regs[info], tmp); unexpected = !save_allowed; break; + case UWOP_SAVE_XMM: if (ui->Version == 1) { - tmp = bfd_get_16 (abfd, &dta[2]) * 8; + if (dta + 4 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_16 (abfd, dta + 2) * 8; i++; fprintf (file, "save mm%u at rsp + 0x%x", info, tmp); unexpected = !save_allowed; @@ -249,24 +315,43 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, unexpected = TRUE; } break; + case UWOP_SAVE_XMM_FAR: - tmp = bfd_get_32 (abfd, &dta[2]) * 8; + if (dta + 6 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_32 (abfd, dta + 2) * 8; i += 2; fprintf (file, "save mm%u at rsp + 0x%x", info, tmp); unexpected = !save_allowed; break; + case UWOP_SAVE_XMM128: - tmp = bfd_get_16 (abfd, &dta[2]) * 16; + if (dta + 4 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_16 (abfd, dta + 2) * 16; i++; fprintf (file, "save xmm%u at rsp + 0x%x", info, tmp); unexpected = !save_allowed; break; + case UWOP_SAVE_XMM128_FAR: - tmp = bfd_get_32 (abfd, &dta[2]) * 16; + if (dta + 6 > ui->rawUnwindCodesEnd) + { + fprintf (file, _("warning: corrupt unwind data\n")); + return; + } + tmp = bfd_get_32 (abfd, dta + 2) * 16; i += 2; fprintf (file, "save xmm%u at rsp + 0x%x", info, tmp); unexpected = !save_allowed; break; + case UWOP_PUSH_MACHFRAME: fprintf (file, "interrupt entry (SS, old RSP, EFLAGS, CS, RIP"); if (info == 0) @@ -276,11 +361,13 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd, else fprintf (file, ", unknown(%u))", info); break; + default: /* PR 17512: file: 2245-7442-0.004. */ fprintf (file, _("Unknown: %x"), PEX64_UNWCODE_CODE (dta[1])); break; - } + } + if (unexpected) fprintf (file, " [Unexpected!]"); fputc ('\n', file); @@ -338,14 +425,18 @@ pex64_dump_xdata (FILE *file, bfd *abfd, /* PR 17512: file: 2245-7442-0.004. */ if (end_addr > sec_size) { - fprintf (file, _("warning: xdata section corrupt")); + fprintf (file, _("warning: xdata section corrupt\n")); end_addr = sec_size; } } else end_addr = sec_size; - pex64_get_unwind_info (abfd, &ui, &xdata[addr]); + if (! pex64_get_unwind_info (abfd, &ui, xdata + addr, xdata + end_addr)) + { + fprintf (file, _("warning: xdata section corrupt\n")); + return; + } if (ui.Version != 1 && ui.Version != 2) { @@ -503,7 +594,7 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) /* virt_size might be zero for objects. */ if (stop == 0 && strcmp (abfd->xvec->name, "pe-x86-64") == 0) { - stop = (datasize / onaline) * onaline; + stop = datasize; virt_size_is_zero = TRUE; } else if (datasize < stop) @@ -513,8 +604,8 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) _("Warning: %s section size (%ld) is smaller than virtual size (%ld)\n"), pdata_section->name, (unsigned long) datasize, (unsigned long) stop); - /* Be sure not to read passed datasize. */ - stop = datasize / onaline; + /* Be sure not to read past datasize. */ + stop = datasize; } /* Display functions table. */ @@ -679,15 +770,14 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) if (PEX64_IS_RUNTIME_FUNCTION_CHAINED (&rf)) { bfd_vma altent = PEX64_GET_UNWINDDATA_UNIFIED_RVA (&rf); - bfd_vma pdata_vma = bfd_get_section_vma (abfd, pdata_section); + bfd_vma pdata_vma = bfd_section_vma (pdata_section); struct pex64_runtime_function arf; fprintf (file, "\t shares information with "); altent += imagebase; if (altent >= pdata_vma - && (altent + PDATA_ROW_SIZE <= pdata_vma - + pei_section_data (abfd, pdata_section)->virt_size)) + && altent - pdata_vma + PDATA_ROW_SIZE <= stop) { pex64_get_runtime_function (abfd, &arf, &pdata[altent - pdata_vma]);