From 04f963fd489cae724a60140e13984415c205f4ac Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Wed, 14 Jun 2017 10:35:16 +0100 Subject: [PATCH] Fix seg-faults in objdump when disassembling a corrupt versados binary. PR binutils/21591 * versados.c (versados_mkobject): Zero the allocated tdata structure. (process_otr): Check for an invalid offset in the otr structure. Upstream-Status: Backport CVE: CVE-2017-9753 CVE: CVE-2017-9754 Signed-off-by: Armin Kuster --- bfd/ChangeLog | 6 ++++++ bfd/versados.c | 12 ++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) Index: git/bfd/versados.c =================================================================== --- git.orig/bfd/versados.c +++ git/bfd/versados.c @@ -149,7 +149,7 @@ versados_mkobject (bfd *abfd) if (abfd->tdata.versados_data == NULL) { bfd_size_type amt = sizeof (tdata_type); - tdata_type *tdata = bfd_alloc (abfd, amt); + tdata_type *tdata = bfd_zalloc (abfd, amt); if (tdata == NULL) return FALSE; @@ -345,13 +345,13 @@ reloc_howto_type versados_howto_table[] }; static int -get_offset (int len, unsigned char *ptr) +get_offset (unsigned int len, unsigned char *ptr) { int val = 0; if (len) { - int i; + unsigned int i; val = *ptr++; if (val & 0x80) @@ -394,9 +394,13 @@ process_otr (bfd *abfd, struct ext_otr * int flag = *srcp++; int esdids = (flag >> 5) & 0x7; int sizeinwords = ((flag >> 3) & 1) ? 2 : 1; - int offsetlen = flag & 0x7; + unsigned int offsetlen = flag & 0x7; int j; + /* PR 21591: Check for invalid lengths. */ + if (srcp + esdids + offsetlen >= endp) + return; + if (esdids == 0) { /* A zero esdid means the new pc is the offset given. */ Index: git/bfd/ChangeLog =================================================================== --- git.orig/bfd/ChangeLog +++ git/bfd/ChangeLog @@ -8,6 +8,10 @@ (ieee_archive_p): Likewise. 2017-06-14 Nick Clifton + + PR binutils/21591 + * versados.c (versados_mkobject): Zero the allocated tdata structure. + (process_otr): Check for an invalid offset in the otr structure. PR binutils/21589 * vms-alpha.c (_bfd_vms_get_value): Add an extra parameter - the