From a67d66eb97e7613a38ffe6622d837303b3ecd31d Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Wed, 1 Nov 2017 15:21:46 +0000 Subject: [PATCH] Prevent illegal memory accesses when attempting to read excessively large COFF line number tables. PR 22376 * coffcode.h (coff_slurp_line_table): Check for an excessively large line number count. Upstream-Status: Backport Affects: <= 2.29.1 CVE: CVE-2017-16826 Signed-off-by: Armin Kuster --- bfd/ChangeLog | 6 ++++++ bfd/coffcode.h | 8 ++++++++ 2 files changed, 14 insertions(+) Index: git/bfd/coffcode.h =================================================================== --- git.orig/bfd/coffcode.h +++ git/bfd/coffcode.h @@ -4578,6 +4578,14 @@ coff_slurp_line_table (bfd *abfd, asecti BFD_ASSERT (asect->lineno == NULL); + if (asect->lineno_count > asect->size) + { + _bfd_error_handler + (_("%B: warning: line number count (%#lx) exceeds section size (%#lx)"), + abfd, (unsigned long) asect->lineno_count, (unsigned long) asect->size); + return FALSE; + } + amt = ((bfd_size_type) asect->lineno_count + 1) * sizeof (alent); lineno_cache = (alent *) bfd_alloc (abfd, amt); if (lineno_cache == NULL) Index: git/bfd/ChangeLog =================================================================== --- git.orig/bfd/ChangeLog +++ git/bfd/ChangeLog @@ -1,3 +1,9 @@ +2017-11-01 Nick Clifton + + PR 22376 + * coffcode.h (coff_slurp_line_table): Check for an excessively + large line number count. + 2017-10-28 Alan Modra PR 22361