1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
From 6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Fri, 3 Nov 2017 11:55:21 +0000
Subject: [PATCH] Fix excessive memory allocation attempts and possible integer
overfloaws when attempting to read a COFF binary with a corrupt symbol count.
PR 22385
* coffgen.c (_bfd_coff_get_external_symbols): Check for an
overlarge raw syment count.
(coff_get_normalized_symtab): Likewise.
Upstream-Status: Backport
Affects: <= 2.29.1
CVE: CVE-2017-16831
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 8 ++++++++
bfd/coffgen.c | 17 +++++++++++++++--
2 files changed, 23 insertions(+), 2 deletions(-)
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,11 @@
+2017-11-03 Mingi Cho <mgcho.minic@gmail.com>
+ Nick Clifton <nickc@redhat.com>
+
+ PR 22385
+ * coffgen.c (_bfd_coff_get_external_symbols): Check for an
+ overlarge raw syment count.
+ (coff_get_normalized_symtab): Likewise.
+
2017-10-17 Alan Modra <amodra@gmail.com>
PR 22307
Index: git/bfd/coffgen.c
===================================================================
--- git.orig/bfd/coffgen.c
+++ git/bfd/coffgen.c
@@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abf
size = obj_raw_syment_count (abfd) * symesz;
if (size == 0)
return TRUE;
+ /* Check for integer overflow and for unreasonable symbol counts. */
+ if (size < obj_raw_syment_count (abfd)
+ || (bfd_get_file_size (abfd) > 0
+ && size > bfd_get_file_size (abfd)))
+
+ {
+ _bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
+ abfd, obj_raw_syment_count (abfd));
+ return FALSE;
+ }
syms = bfd_malloc (size);
if (syms == NULL)
{
/* PR 21013: Provide an error message when the alloc fails. */
- _bfd_error_handler (_("%B: Not enough memory to allocate space for %lu symbols"),
- abfd, size);
+ _bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
+ abfd, obj_raw_syment_count (abfd), symesz);
return FALSE;
}
@@ -1790,6 +1800,9 @@ coff_get_normalized_symtab (bfd *abfd)
return NULL;
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
+ /* Check for integer overflow. */
+ if (size < obj_raw_syment_count (abfd))
+ return NULL;
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
if (internal == NULL && size != 0)
return NULL;
|
