Prevent a seg-fault in the linker when accessing a specially crafted, corrupt, aout...

	PR ld/19629
	* aoutx.h (aout_link_add_symbols): Check for out of range string
	table offsets.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index b1b404765e17e2096ad84597b996afc4844ce4b1..17b24c10b07cca55220b40409c751af5f84f7d3c 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,9 @@
 2016-02-19  Nick Clifton  <nickc@redhat.com>
 
+       PR ld/19629
+       * aoutx.h (aout_link_add_symbols): Check for out of range string
+       table offsets.
+
        PR ld/19628
        * reloc.c (bfd_generic_get_relocated_section_contents): Stop
        processing if we encounter a reloc without an associated symbol.

diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index 665afe4974d5192af93d95f9456c46a4a40129d4..61ac9b3e69ffc44d45b8805182b984ead6776077 100644 (file)
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -3002,7 +3002,11 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
       if ((type & N_STAB) != 0)
        continue;
 
+      /* PR 19629: Corrupt binaries can contain illegal string offsets.  */
+      if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
+       return FALSE;
       name = strings + GET_WORD (abfd, p->e_strx);
+      
       value = GET_WORD (abfd, p->e_value);
       flags = BSF_GLOBAL;
       string = NULL;
@@ -3060,6 +3064,9 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
             which this one really is.  */
          BFD_ASSERT (p + 1 < pend);
          ++p;
+         /* PR 19629: Corrupt binaries can contain illegal string offsets.  */
+         if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
+           return FALSE;
          string = strings + GET_WORD (abfd, p->e_strx);
          section = bfd_ind_section_ptr;
          flags |= BSF_INDIRECT;
@@ -3093,6 +3100,9 @@ aout_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
            return TRUE;
          ++p;
          string = name;
+         /* PR 19629: Corrupt binaries can contain illegal string offsets.  */
+         if (GET_WORD (abfd, p->e_strx) > obj_aout_external_string_size (abfd))
+           return FALSE;
          name = strings + GET_WORD (abfd, p->e_strx);
          section = bfd_und_section_ptr;
          flags |= BSF_WARNING;