Fix address violation errors parsing corrupt binary files.

	PR 21813
binutils* rddbg.c (read_symbol_stabs_debugging_info): Check for an empty
	string whilst concatenating symbol names.

bfd	* mach-o.c (bfd_mach_o_canonicalize_relocs): Pass the base address
	of the relocs to the canonicalize_one_reloc routine.
	* mach-o.h (struct bfd_mach_o_backend_data): Update the prototype
	for the _bfd_mach_o_canonicalize_one_reloc field.
	* mach-o-arm.c (bfd_mach_o_arm_canonicalize_one_reloc): Add
	res_base parameter.  Use to check for corrupt pair relocs.
	* mach-o-aarch64.c (bfd_mach_o_arm64_canonicalize_one_reloc):
	Likewise.
	* mach-o-i386.c (bfd_mach_o_i386_canonicalize_one_reloc):
	Likewise.
	* mach-o-x86-64.c (bfd_mach_o_x86_64_canonicalize_one_reloc):
	Likewise.

	* vms-alpha.c (_bfd_vms_slurp_eihd): Make sure that there is
	enough data in the record before attempting to parse it.
	(_bfd_vms_slurp_eeom): Likewise.

	(_bfd_vms_slurp_egsd): Check for an invalid section index.
	(image_set_ptr): Likewise.
	(alpha_vms_slurp_relocs): Likewise.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index e3da4f508db7872d5c48790cf9511a3e98af00d7..a854a1266e1c1afa81ed40259c7504a6145e6a58 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,27 @@
+2017-07-24  Nick Clifton  <nickc@redhat.com>
+
+       PR 21813
+       * mach-o.c (bfd_mach_o_canonicalize_relocs): Pass the base address
+       of the relocs to the canonicalize_one_reloc routine.
+       * mach-o.h (struct bfd_mach_o_backend_data): Update the prototype
+       for the _bfd_mach_o_canonicalize_one_reloc field.
+       * mach-o-arm.c (bfd_mach_o_arm_canonicalize_one_reloc): Add
+       res_base parameter.  Use to check for corrupt pair relocs.
+       * mach-o-aarch64.c (bfd_mach_o_arm64_canonicalize_one_reloc):
+       Likewise.
+       * mach-o-i386.c (bfd_mach_o_i386_canonicalize_one_reloc):
+       Likewise.
+       * mach-o-x86-64.c (bfd_mach_o_x86_64_canonicalize_one_reloc):
+       Likewise.
+
+       * vms-alpha.c (_bfd_vms_slurp_eihd): Make sure that there is
+       enough data in the record before attempting to parse it.
+       (_bfd_vms_slurp_eeom): Likewise.
+
+       (_bfd_vms_slurp_egsd): Check for an invalid section index.
+       (image_set_ptr): Likewise.
+       (alpha_vms_slurp_relocs): Likewise.
+
 2017-07-24  Nick Clifton  <nickc@redhat.com>
 
        PR 21803

diff --git a/bfd/mach-o-aarch64.c b/bfd/mach-o-aarch64.c
index 12fc47eb0a33723af003edf36e1bba9cf3e16904..5cf336433f99a91497e1c7bf93eecc5dfb6c8e6b 100644 (file)
--- a/bfd/mach-o-aarch64.c
+++ b/bfd/mach-o-aarch64.c
@@ -147,9 +147,11 @@ static reloc_howto_type arm64_howto_table[]=
 };
 
 static bfd_boolean
-bfd_mach_o_arm64_canonicalize_one_reloc (bfd *abfd,
-                                      struct mach_o_reloc_info_external *raw,
-                                        arelent *res, asymbol **syms)
+bfd_mach_o_arm64_canonicalize_one_reloc (bfd *       abfd,
+                                        struct mach_o_reloc_info_external * raw,
+                                        arelent *   res,
+                                        asymbol **  syms,
+                                        arelent *   res_base ATTRIBUTE_UNUSED)
 {
   bfd_mach_o_reloc_info reloc;
 

diff --git a/bfd/mach-o-arm.c b/bfd/mach-o-arm.c
index 5139f795f2429fb445d2600dfff45332cb894bf3..9eb614c4805aa0e021481b5067f1dadcdc16ac20 100644 (file)
--- a/bfd/mach-o-arm.c
+++ b/bfd/mach-o-arm.c
@@ -30,7 +30,7 @@
 #define bfd_mach_o_mkobject bfd_mach_o_arm_mkobject
 
 #define bfd_mach_o_canonicalize_one_reloc bfd_mach_o_arm_canonicalize_one_reloc
-#define bfd_mach_o_swap_reloc_out NULL
+#define bfd_mach_o_swap_reloc_out  NULL
 #define bfd_mach_o_bfd_reloc_type_lookup bfd_mach_o_arm_bfd_reloc_type_lookup
 #define bfd_mach_o_bfd_reloc_name_lookup bfd_mach_o_arm_bfd_reloc_name_lookup
 
@@ -147,9 +147,11 @@ static reloc_howto_type arm_howto_table[]=
 };
 
 static bfd_boolean
-bfd_mach_o_arm_canonicalize_one_reloc (bfd *abfd,
-                                      struct mach_o_reloc_info_external *raw,
-                                      arelent *res, asymbol **syms)
+bfd_mach_o_arm_canonicalize_one_reloc (bfd *       abfd,
+                                      struct mach_o_reloc_info_external * raw,
+                                      arelent *   res,
+                                      asymbol **  syms,
+                                      arelent *   res_base)
 {
   bfd_mach_o_reloc_info reloc;
 
@@ -161,6 +163,9 @@ bfd_mach_o_arm_canonicalize_one_reloc (bfd *abfd,
       switch (reloc.r_type)
         {
         case BFD_MACH_O_ARM_RELOC_PAIR:
+         /* PR 21813: Check for a corrupt PAIR reloc at the start.  */
+         if (res == res_base)
+           return FALSE;
           if (reloc.r_length == 2)
             {
              res->howto = &arm_howto_table[7];

diff --git a/bfd/mach-o-i386.c b/bfd/mach-o-i386.c
index ce0389e020ceaf259f046598e5fb16b83c24bbb5..803af983f550c1c259fb9960c716a18fe9e191d2 100644 (file)
--- a/bfd/mach-o-i386.c
+++ b/bfd/mach-o-i386.c
@@ -112,9 +112,11 @@ static reloc_howto_type i386_howto_table[]=
 };
 
 static bfd_boolean
-bfd_mach_o_i386_canonicalize_one_reloc (bfd *abfd,
-                                       struct mach_o_reloc_info_external *raw,
-                                       arelent *res, asymbol **syms)
+bfd_mach_o_i386_canonicalize_one_reloc (bfd *       abfd,
+                                       struct mach_o_reloc_info_external * raw,
+                                       arelent *   res,
+                                       asymbol **  syms,
+                                       arelent *   res_base)
 {
   bfd_mach_o_reloc_info reloc;
 
@@ -126,6 +128,9 @@ bfd_mach_o_i386_canonicalize_one_reloc (bfd *abfd,
       switch (reloc.r_type)
         {
         case BFD_MACH_O_GENERIC_RELOC_PAIR:
+         /* PR 21813: Check for a corrupt PAIR reloc at the start.  */
+         if (res == res_base)
+           return FALSE;
           if (reloc.r_length == 2)
             {
              res->howto = &i386_howto_table[7];
@@ -391,9 +396,9 @@ const mach_o_segment_name_xlat mach_o_i386_segsec_names_xlat[] =
     { NULL, NULL }
   };
 
-#define bfd_mach_o_canonicalize_one_reloc bfd_mach_o_i386_canonicalize_one_reloc
-#define bfd_mach_o_swap_reloc_out bfd_mach_o_i386_swap_reloc_out
-#define bfd_mach_o_print_thread bfd_mach_o_i386_print_thread
+#define bfd_mach_o_canonicalize_one_reloc  bfd_mach_o_i386_canonicalize_one_reloc
+#define bfd_mach_o_swap_reloc_out          bfd_mach_o_i386_swap_reloc_out
+#define bfd_mach_o_print_thread            bfd_mach_o_i386_print_thread
 
 #define bfd_mach_o_tgt_seg_table mach_o_i386_segsec_names_xlat
 #define bfd_mach_o_section_type_valid_for_tgt NULL

diff --git a/bfd/mach-o-x86-64.c b/bfd/mach-o-x86-64.c
index 1c83b1083db3b5e2936601d78768db766923762e..2c5047616c4f87217f4317d51329b7df9d5ebd18 100644 (file)
--- a/bfd/mach-o-x86-64.c
+++ b/bfd/mach-o-x86-64.c
@@ -120,9 +120,11 @@ static reloc_howto_type x86_64_howto_table[]=
 };
 
 static bfd_boolean
-bfd_mach_o_x86_64_canonicalize_one_reloc (bfd *abfd,
-                                       struct mach_o_reloc_info_external *raw,
-                                       arelent *res, asymbol **syms)
+bfd_mach_o_x86_64_canonicalize_one_reloc (bfd *       abfd,
+                                         struct mach_o_reloc_info_external * raw,
+                                         arelent *   res,
+                                         asymbol **  syms,
+                                         arelent *   res_base ATTRIBUTE_UNUSED)
 {
   bfd_mach_o_reloc_info reloc;
 

diff --git a/bfd/mach-o.c b/bfd/mach-o.c
index be2fb17d332ec2bdacf900e56d88776830afebaf..1807391d51be22bd3ec836b1425e432b19efbb92 100644 (file)
--- a/bfd/mach-o.c
+++ b/bfd/mach-o.c
@@ -1496,7 +1496,7 @@ bfd_mach_o_canonicalize_relocs (bfd *abfd, unsigned long filepos,
   for (i = 0; i < count; i++)
     {
       if (!(*bed->_bfd_mach_o_canonicalize_one_reloc)(abfd, &native_relocs[i],
-                                                     &res[i], syms))
+                                                     &res[i], syms, res))
         goto err;
     }
   free (native_relocs);

diff --git a/bfd/mach-o.h b/bfd/mach-o.h
index 83660a4ce9a56784cad1eb04180a67d690694cf6..0719b53b1e07bde72aa3ed35176e50f54e647017 100644 (file)
--- a/bfd/mach-o.h
+++ b/bfd/mach-o.h
@@ -746,7 +746,7 @@ typedef struct bfd_mach_o_backend_data
   enum bfd_architecture arch;
   bfd_vma page_size;
   bfd_boolean (*_bfd_mach_o_canonicalize_one_reloc)
-    (bfd *, struct mach_o_reloc_info_external *, arelent *, asymbol **);
+  (bfd *, struct mach_o_reloc_info_external *, arelent *, asymbol **, arelent *);
   bfd_boolean (*_bfd_mach_o_swap_reloc_out)(arelent *, bfd_mach_o_reloc_info *);
   bfd_boolean (*_bfd_mach_o_print_thread)(bfd *, bfd_mach_o_thread_flavour *,
                                           void *, char *);

diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c
index 991a1bed3c6d3de512b684f976cfe823b0c2e536..5e9170d7b1be9e9213685bdf372d718f86e77ea7 100644 (file)
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@@ -473,6 +473,14 @@ _bfd_vms_slurp_eihd (bfd *abfd, unsigned int *eisd_offset,
 
   vms_debug2 ((8, "_bfd_vms_slurp_eihd\n"));
 
+  /* PR 21813: Check for an undersized record.  */
+  if (PRIV (recrd.buf_size) < sizeof (* eihd))
+    {
+      _bfd_error_handler (_("Corrupt EIHD record - size is too small"));
+      bfd_set_error (bfd_error_bad_value);
+      return FALSE;
+    }
+
   size = bfd_getl32 (eihd->size);
   imgtype = bfd_getl32 (eihd->imgtype);
 
@@ -1312,19 +1320,38 @@ _bfd_vms_slurp_egsd (bfd *abfd)
            if (old_flags & EGSY__V_DEF)
               {
                 struct vms_esdf *esdf = (struct vms_esdf *)vms_rec;
+               long psindx;
 
                entry->value = bfd_getl64 (esdf->value);
                if (PRIV (sections) == NULL)
                  return FALSE;
-               entry->section = PRIV (sections)[bfd_getl32 (esdf->psindx)];
+
+               psindx = bfd_getl32 (esdf->psindx);
+               /* PR 21813: Check for an out of range index.  */
+               if (psindx < 0 || psindx >= (int) PRIV (section_count))
+                 {
+                   _bfd_error_handler (_("Corrupt EGSD record: its psindx field is too big (%#lx)"),
+                                       psindx);
+                   bfd_set_error (bfd_error_bad_value);
+                   return FALSE;
+                 }
+               entry->section = PRIV (sections)[psindx];
 
                 if (old_flags & EGSY__V_NORM)
                   {
                     PRIV (norm_sym_count)++;
 
                     entry->code_value = bfd_getl64 (esdf->code_address);
-                    entry->code_section =
-                      PRIV (sections)[bfd_getl32 (esdf->ca_psindx)];
+                   psindx = bfd_getl32 (esdf->ca_psindx);
+               /* PR 21813: Check for an out of range index.  */
+                   if (psindx < 0 || psindx >= (int) PRIV (section_count))
+                     {
+                       _bfd_error_handler (_("Corrupt EGSD record: its psindx field is too big (%#lx)"),
+                                           psindx);
+                       bfd_set_error (bfd_error_bad_value);
+                       return FALSE;
+                     }
+                    entry->code_section = PRIV (sections)[psindx];
                   }
               }
          }
@@ -1351,9 +1378,20 @@ _bfd_vms_slurp_egsd (bfd *abfd)
 
             if (old_flags & EGSY__V_REL)
              {
+               long psindx;
+
                if (PRIV (sections) == NULL)
                  return FALSE;
-               entry->section = PRIV (sections)[bfd_getl32 (egst->psindx)];
+               psindx = bfd_getl32 (egst->psindx);
+               /* PR 21813: Check for an out of range index.  */
+               if (psindx < 0 || psindx >= (int) PRIV (section_count))
+                 {
+                   _bfd_error_handler (_("Corrupt EGSD record: its psindx field is too big (%#lx)"),
+                                       psindx);
+                   bfd_set_error (bfd_error_bad_value);
+                   return FALSE;
+                 }
+               entry->section = PRIV (sections)[psindx];
              }
             else
               entry->section = bfd_abs_section_ptr;
@@ -1446,6 +1484,9 @@ image_set_ptr (bfd *abfd, bfd_vma vma, int sect, struct bfd_link_info *info)
 
   if (PRIV (sections) == NULL)
     return;
+  if (sect < 0 || sect >= (int) PRIV (section_count))
+    return;
+
   sec = PRIV (sections)[sect];
 
   if (info)
@@ -2450,6 +2491,14 @@ _bfd_vms_slurp_eeom (bfd *abfd)
 
   vms_debug2 ((2, "EEOM\n"));
 
+  /* PR 21813: Check for an undersized record.  */
+  if (PRIV (recrd.buf_size) < sizeof (* eeom))
+    {
+      _bfd_error_handler (_("Corrupt EEOM record - size is too small"));
+      bfd_set_error (bfd_error_bad_value);
+      return FALSE;
+    }
+
   PRIV (eom_data).eom_l_total_lps = bfd_getl32 (eeom->total_lps);
   PRIV (eom_data).eom_w_comcod = bfd_getl16 (eeom->comcod);
   if (PRIV (eom_data).eom_w_comcod > 1)
@@ -5173,7 +5222,7 @@ alpha_vms_slurp_relocs (bfd *abfd)
               }
             else if (cur_psidx >= 0)
              {
-               if (PRIV (sections) == NULL)
+               if (PRIV (sections) == NULL || cur_psidx >= (int) PRIV (section_count))
                  return FALSE;
                reloc->sym_ptr_ptr =
                  PRIV (sections)[cur_psidx]->symbol_ptr_ptr;

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 0d4260401d2ca2d50eb497303566e6b6de2be862..920e938cc2e93fddb438bde07676c5a1e54384dd 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2017-07-24  Nick Clifton  <nickc@redhat.com>
+
+       PR 21813
+       * rddbg.c (read_symbol_stabs_debugging_info): Check for an empty
+       string whilst concatenating symbol names.
+
 2017-07-21  Nick Clifton  <nickc@redhat.com>
 
        * po/fr.po: Updated French translation.

diff --git a/binutils/rddbg.c b/binutils/rddbg.c
index 1d8c4471887c29877ef23d021b05bb5b22ca9c61..b9780608cf366561cf4de2c261fb3c8248cbd55d 100644 (file)
--- a/binutils/rddbg.c
+++ b/binutils/rddbg.c
@@ -303,7 +303,8 @@ read_symbol_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
            return FALSE;
          f = NULL;
 
-         while (s[strlen (s) - 1] == '\\'
+         while (strlen (s) > 0
+                && s[strlen (s) - 1] == '\\'
                 && ps + 1 < symend)
            {
              char *sc, *n;