Skip to content

Commit

Permalink
Fix potential illegal memory access failures in the BFD library by en…
Browse files Browse the repository at this point in the history 
…suring that the return value from bfd_malloc() is checked before it is used.

	PR 25308
	* elf-properties.c (_bfd_elf_convert_gnu_properties): Check the
	return value from bfd_malloc.
	* elf32-arm.c (bfd_elf32_arm_vfp11_fix_veneer_locations): Likewise.
	(bfd_elf32_arm_stm32l4xx_fix_veneer_locations): Likewise.
	(elf32_arm_filter_cmse_symbols): Likewise.
	(elf32_arm_write_section): Likewise.
	* mach-o.c (bfd_mach_o_core_fetch_environment): Likewise.
	(bfd_mach_o_follow_dsym): Likewise.
	* pef.c (bfd_pef_print_loader_section): Likewise.
	(bfd_pef_scan_start_address): Likewise.
	(bfd_pef_parse_function_stubs): Likewise.
	(bfd_pef_parse_symbols): Likewise.
  • Loading branch information
@nickclifton
nickclifton committed Jan 3, 2020
1 parent a232201 commit 7a0fb7b
Show file tree
Hide file tree
Showing 5 changed files with 42 additions and 5 deletions.
16 changes: 16 additions & 0 deletions bfd/ChangeLog
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,19 @@
2020-01-03 Nick Clifton <nickc@redhat.com>

PR 25308
* elf-properties.c (_bfd_elf_convert_gnu_properties): Check the
return value from bfd_malloc.
* elf32-arm.c (bfd_elf32_arm_vfp11_fix_veneer_locations): Likewise.
(bfd_elf32_arm_stm32l4xx_fix_veneer_locations): Likewise.
(elf32_arm_filter_cmse_symbols): Likewise.
(elf32_arm_write_section): Likewise.
* mach-o.c (bfd_mach_o_core_fetch_environment): Likewise.
(bfd_mach_o_follow_dsym): Likewise.
* pef.c (bfd_pef_print_loader_section): Likewise.
(bfd_pef_scan_start_address): Likewise.
(bfd_pef_parse_function_stubs): Likewise.
(bfd_pef_parse_symbols): Likewise.

2020-01-03 Sergei Trofimovich <siarheit@google.com>

* elfnn-ia64.c (elfNN_ia64_merge_private_bfd_data): don't fail
Expand Down
2 changes: 2 additions & 0 deletions bfd/elf-properties.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -703,6 +703,8 @@ _bfd_elf_convert_gnu_properties (bfd *ibfd, asection *isec,
if (size > bfd_section_size (isec))
{
contents = (bfd_byte *) bfd_malloc (size);
if (contents == NULL)
return FALSE;
free (*ptr);
*ptr = contents;
}
Expand Down
11 changes: 6 additions & 5 deletions bfd/elf32-arm.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7148,7 +7148,6 @@ find_arm_glue (struct bfd_link_info *link_info,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen (name)
+ strlen (ARM2THUMB_GLUE_ENTRY_NAME) + 1);

BFD_ASSERT (tmp_name);

sprintf (tmp_name, ARM2THUMB_GLUE_ENTRY_NAME, name);
Expand Down Expand Up @@ -7323,7 +7322,6 @@ record_arm_to_thumb_glue (struct bfd_link_info * link_info,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen (name)
+ strlen (ARM2THUMB_GLUE_ENTRY_NAME) + 1);

BFD_ASSERT (tmp_name);

sprintf (tmp_name, ARM2THUMB_GLUE_ENTRY_NAME, name);
Expand Down Expand Up @@ -7401,7 +7399,6 @@ record_arm_bx_glue (struct bfd_link_info * link_info, int reg)
/* Add symbol for veneer. */
tmp_name = (char *)
bfd_malloc ((bfd_size_type) strlen (ARM_BX_GLUE_ENTRY_NAME) + 1);

BFD_ASSERT (tmp_name);

sprintf (tmp_name, ARM_BX_GLUE_ENTRY_NAME, reg);
Expand Down Expand Up @@ -7493,7 +7490,6 @@ record_vfp11_erratum_veneer (struct bfd_link_info *link_info,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen
(VFP11_ERRATUM_VENEER_ENTRY_NAME) + 10);

BFD_ASSERT (tmp_name);

sprintf (tmp_name, VFP11_ERRATUM_VENEER_ENTRY_NAME,
Expand Down Expand Up @@ -7613,7 +7609,6 @@ record_stm32l4xx_erratum_veneer (struct bfd_link_info *link_info,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen
(STM32L4XX_ERRATUM_VENEER_ENTRY_NAME) + 10);

BFD_ASSERT (tmp_name);

sprintf (tmp_name, STM32L4XX_ERRATUM_VENEER_ENTRY_NAME,
Expand Down Expand Up @@ -8644,6 +8639,7 @@ bfd_elf32_arm_vfp11_fix_veneer_locations (bfd *abfd,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen
(VFP11_ERRATUM_VENEER_ENTRY_NAME) + 10);
BFD_ASSERT (tmp_name);

for (sec = abfd->sections; sec != NULL; sec = sec->next)
{
Expand Down Expand Up @@ -8731,6 +8727,7 @@ bfd_elf32_arm_stm32l4xx_fix_veneer_locations (bfd *abfd,

tmp_name = (char *) bfd_malloc ((bfd_size_type) strlen
(STM32L4XX_ERRATUM_VENEER_ENTRY_NAME) + 10);
BFD_ASSERT (tmp_name);

for (sec = abfd->sections; sec != NULL; sec = sec->next)
{
Expand Down Expand Up @@ -18505,6 +18502,8 @@ elf32_arm_filter_cmse_symbols (bfd *abfd ATTRIBUTE_UNUSED,

maxnamelen = 128;
cmse_name = (char *) bfd_malloc (maxnamelen);
BFD_ASSERT (cmse_name);

for (src_count = 0; src_count < symcount; src_count++)
{
struct elf32_arm_link_hash_entry *cmse_hash;
Expand Down Expand Up @@ -19700,6 +19699,8 @@ elf32_arm_write_section (bfd *output_bfd,
unsigned int in_index, out_index;
bfd_vma add_to_offsets = 0;

if (edited_contents == NULL)
return FALSE;
for (in_index = 0, out_index = 0; in_index * 8 < input_size || edit_node;)
{
if (edit_node)
Expand Down
7 changes: 7 additions & 0 deletions bfd/mach-o.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5752,6 +5752,8 @@ bfd_mach_o_core_fetch_environment (bfd *abfd,
unsigned char *buf = bfd_malloc (1024);
unsigned long size = 1024;

if (buf == NULL)
return -1;
for (;;)
{
bfd_size_type nread = 0;
Expand Down Expand Up @@ -5797,6 +5799,8 @@ bfd_mach_o_core_fetch_environment (bfd *abfd,
bottom = seg->fileoff + seg->filesize - offset;
top = seg->fileoff + seg->filesize - 4;
*rbuf = bfd_malloc (top - bottom);
if (*rbuf == NULL)
return -1;
*rlen = top - bottom;

memcpy (*rbuf, buf + size - *rlen, *rlen);
Expand Down Expand Up @@ -5941,6 +5945,9 @@ bfd_mach_o_follow_dsym (bfd *abfd)
dsym_filename = (char *)bfd_malloc (strlen (base_bfd->filename)
+ strlen (dsym_subdir) + 1
+ strlen (base_basename) + 1);
if (dsym_filename == NULL)
return NULL;

sprintf (dsym_filename, "%s%s/%s",
base_bfd->filename, dsym_subdir, base_basename);

Expand Down
11 changes: 11 additions & 0 deletions bfd/pef.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -447,6 +447,8 @@ bfd_pef_print_loader_section (bfd *abfd, FILE *file)

loaderlen = loadersec->size;
loaderbuf = bfd_malloc (loaderlen);
if (loaderbuf == NULL)
return -1;

if (bfd_seek (abfd, loadersec->filepos, SEEK_SET) < 0
|| bfd_bread ((void *) loaderbuf, loaderlen, abfd) != loaderlen
Expand Down Expand Up @@ -478,6 +480,9 @@ bfd_pef_scan_start_address (bfd *abfd)

loaderlen = loadersec->size;
loaderbuf = bfd_malloc (loaderlen);
if (loaderbuf == NULL)
goto end;

if (bfd_seek (abfd, loadersec->filepos, SEEK_SET) < 0)
goto error;
if (bfd_bread ((void *) loaderbuf, loaderlen, abfd) != loaderlen)
Expand Down Expand Up @@ -753,6 +758,8 @@ bfd_pef_parse_function_stubs (bfd *abfd,
(header.imported_library_count * sizeof (bfd_pef_imported_library));
imports = bfd_malloc
(header.total_imported_symbol_count * sizeof (bfd_pef_imported_symbol));
if (libraries == NULL || imports == NULL)
goto error;

if (loaderlen < (56 + (header.imported_library_count * 24)))
goto error;
Expand Down Expand Up @@ -897,6 +904,8 @@ bfd_pef_parse_symbols (bfd *abfd, asymbol **csym)
{
codelen = codesec->size;
codebuf = bfd_malloc (codelen);
if (codebuf == NULL)
goto end;
if (bfd_seek (abfd, codesec->filepos, SEEK_SET) < 0)
goto end;
if (bfd_bread ((void *) codebuf, codelen, abfd) != codelen)
Expand All @@ -908,6 +917,8 @@ bfd_pef_parse_symbols (bfd *abfd, asymbol **csym)
{
loaderlen = loadersec->size;
loaderbuf = bfd_malloc (loaderlen);
if (loaderbuf == NULL)
goto end;
if (bfd_seek (abfd, loadersec->filepos, SEEK_SET) < 0)
goto end;
if (bfd_bread ((void *) loaderbuf, loaderlen, abfd) != loaderlen)
Expand Down

0 comments on commit 7a0fb7b

Please sign in to comment.