76 lines
2.8 KiB
Diff
76 lines
2.8 KiB
Diff
|
From 28e817cc440bce73691c03e01860089a0954a837 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Nick Clifton <nickc@redhat.com>
|
||
|
|
Date: Wed, 9 Jan 2019 12:25:16 +0000
|
||
|
|
Subject: [PATCH 1/1] Fix a heap use after free memory access fault when
|
||
|
|
displaying error messages about malformed archives.
|
||
|
|
|
||
|
|
PR 14049
|
||
|
|
* readelf.c (process_archive): Use arch.file_name in error
|
||
|
|
messages until the qualified name is available.
|
||
|
|
---
|
||
|
|
|
||
|
|
|
||
|
|
diff -urNp a/binutils/ChangeLog b/binutils/ChangeLog
|
||
|
|
--- a/binutils/ChangeLog 2019-06-06 00:06:39.330000000 +0800
|
||
|
|
+++ b/binutils/ChangeLog 2019-06-06 00:08:54.420000000 +0800
|
||
|
|
@@ -1,3 +1,8 @@
|
||
|
|
+2019-01-09 Nick Clifton <nickc@redhat.com>
|
||
|
|
+ PR 14049
|
||
|
|
+ * readelf.c (process_archive): Use arch.file_name in error
|
||
|
|
+ messages until the qualified name is available.
|
||
|
|
+
|
||
|
|
2018-07-18 Nick Clifton <nickc@redhat.com>
|
||
|
|
|
||
|
|
2.31.1 Release point.
|
||
|
|
diff -urNp a/binutils/readelf.c b/binutils/readelf.c
|
||
|
|
--- a/binutils/readelf.c 2019-06-06 00:06:39.100000000 +0800
|
||
|
|
+++ b/binutils/readelf.c 2019-06-06 00:17:32.740000000 +0800
|
||
|
|
@@ -19088,7 +19088,7 @@ process_archive (Filedata * filedata, bf
|
||
|
|
/* Read the next archive header. */
|
||
|
|
if (fseek (filedata->handle, arch.next_arhdr_offset, SEEK_SET) != 0)
|
||
|
|
{
|
||
|
|
- error (_("%s: failed to seek to next archive header\n"), filedata->file_name);
|
||
|
|
+ error (_("%s: failed to seek to next archive header\n"), arch.file_name);
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
got = fread (&arch.arhdr, 1, sizeof arch.arhdr, filedata->handle);
|
||
|
|
@@ -19096,7 +19096,10 @@ process_archive (Filedata * filedata, bf
|
||
|
|
{
|
||
|
|
if (got == 0)
|
||
|
|
break;
|
||
|
|
- error (_("%s: failed to read archive header\n"), filedata->file_name);
|
||
|
|
+ /* PR 24049 - we cannot use filedata->file_name as this will
|
||
|
|
+ have already been freed. */
|
||
|
|
+ error (_("%s: failed to read archive header\n"), arch.file_name);
|
||
|
|
+
|
||
|
|
ret = FALSE;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
@@ -19116,7 +19119,7 @@ process_archive (Filedata * filedata, bf
|
||
|
|
name = get_archive_member_name (&arch, &nested_arch);
|
||
|
|
if (name == NULL)
|
||
|
|
{
|
||
|
|
- error (_("%s: bad archive file name\n"), filedata->file_name);
|
||
|
|
+ error (_("%s: bad archive file name\n"), arch.file_name);
|
||
|
|
ret = FALSE;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
@@ -19125,7 +19128,7 @@ process_archive (Filedata * filedata, bf
|
||
|
|
qualified_name = make_qualified_name (&arch, &nested_arch, name);
|
||
|
|
if (qualified_name == NULL)
|
||
|
|
{
|
||
|
|
- error (_("%s: bad archive file name\n"), filedata->file_name);
|
||
|
|
+ error (_("%s: bad archive file name\n"), arch.file_name);
|
||
|
|
ret = FALSE;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
@@ -19171,7 +19174,7 @@ process_archive (Filedata * filedata, bf
|
||
|
|
if (nested_arch.file == NULL)
|
||
|
|
{
|
||
|
|
error (_("%s: contains corrupt thin archive: %s\n"),
|
||
|
|
- filedata->file_name, name);
|
||
|
|
+ qualified_name, name);
|
||
|
|
ret = FALSE;
|
||
|
|
break;
|
||
|
|
}
|