Author: emaste
Date: Thu Nov 30 00:25:25 2017
New Revision: 326380
URL: https://svnweb.freebsd.org/changeset/base/326380
Log:
MFC r326136: bfd: avoid crash on corrupt binaries
From binutils commits 5a4b0ccc20ba30caef53b01bee2c0aaa5b855339 and
7e1e19887abd24aeb15066b141cdff5541e0ec8e, made available under GPLv2
by Nick Clifton.
PR: 198824
Security: CVE-2014-8501
Security: CVE-2014-8502
Modified:
stable/10/contrib/binutils/bfd/peXXigen.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/contrib/binutils/bfd/peXXigen.c
==============================================================================
--- stable/10/contrib/binutils/bfd/peXXigen.c Thu Nov 30 00:24:28 2017
(r326379)
+++ stable/10/contrib/binutils/bfd/peXXigen.c Thu Nov 30 00:25:25 2017
(r326380)
@@ -448,6 +448,17 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd,
{
int idx;
+ /* PR 17512: Corrupt PE binaries can cause seg-faults. */
+ if (a->NumberOfRvaAndSizes > 16)
+ {
+ (*_bfd_error_handler)
+ (_("%B: aout header specifies an invalid number of data-directory
entries: %d"),
+ abfd, a->NumberOfRvaAndSizes);
+ /* Paranoia: If the number is corrupt, then assume that the
+ actual entries themselves might be corrupt as well. */
+ a->NumberOfRvaAndSizes = 0;
+ }
+
for (idx = 0; idx < 16; idx++)
{
/* If data directory is empty, rva also should be 0. */
@@ -1426,6 +1437,15 @@ pe_print_edata (bfd * abfd, void * vfile)
section->name);
return TRUE;
}
+ }
+
+ /* PR 17512: Handle corrupt PE binaries. */
+ if (datasize < 36)
+ {
+ fprintf (file,
+ _("\nThere is an export table in %s, but it is too small
(%d)\n"),
+ section->name, (int) datasize);
+ return TRUE;
}
fprintf (file, _("\nThere is an export table in %s at 0x%lx\n"),
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
