binutils/CVE-2019-1010180.patch
2019-12-25 15:42:36 +08:00

33 lines
1.4 KiB
Diff

From 8ff71a9c80cfcf64c54d4ae938c644b1b1ea19fb Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Tue, 18 Sep 2018 16:54:07 +0100
Subject: [PATCH] Add a warning to the bfd library for when it encounters an
ELF file with an invalid section size.
PR 23657
* elfcode.h (elf_swap_shdr_in): Generate a warning message if an
ELF section has contents and size larger than the file size.
url:https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8ff71a9c80cfcf64c54d4ae938c644b1b1ea19fb
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
index fb02e255fd..f224c8b79d 100644
--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
@@ -314,6 +314,14 @@ elf_swap_shdr_in (bfd *abfd,
dst->sh_addr = H_GET_WORD (abfd, src->sh_addr);
dst->sh_offset = H_GET_WORD (abfd, src->sh_offset);
dst->sh_size = H_GET_WORD (abfd, src->sh_size);
+ /* PR 23657. Check for invalid section size, in sections with contents.
+ Note - we do not set an error value here because the contents
+ of this particular section might not be needed by the consumer. */
+ if (dst->sh_type != SHT_NOBITS
+ && dst->sh_size > bfd_get_file_size (abfd))
+ _bfd_error_handler
+ (_("warning: %pB has a corrupt section with a size (%" BFD_VMA_FMT "x) larger than the file size"),
+ abfd, dst->sh_size);
dst->sh_link = H_GET_32 (abfd, src->sh_link);
dst->sh_info = H_GET_32 (abfd, src->sh_info);
dst->sh_addralign = H_GET_WORD (abfd, src->sh_addralign);
--
2.19.1