Bug 16825 - bfd/versados.c: Multiple failures to validate user input
Summary: bfd/versados.c: Multiple failures to validate user input
Status: ASSIGNED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.25
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-04-09 14:55 UTC by klemensbaum
Modified: 2014-10-28 11:54 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
Proposed patch (710 bytes, patch)
2014-10-28 11:54 UTC, Nick Clifton
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description klemensbaum 2014-04-09 14:55:50 UTC
bfd/versados.c:188 get_record
  Failure to validate size allows writing of an arbitrary byte after the structure.

bfd/versados.c:367 process_otr
bfd/versados.c:417 process_otr
bfd/versados.c:444 process_otr
  Failure to validate otr->esdid allows reading and writing into following data members and up to 5719 bytes past the end of the versados_data_struct

bfd/versados.c:433 process_otr
  Null pointer dereference in pass 1

bfd/versados.c:397 process_otr
  Failure to validate dst_idx allows writing user-controlled 4-byte values to memory locations at user-controlled offsets from the contents array.
Comment 1 Nick Clifton 2014-10-28 11:54:17 UTC
Created attachment 7856 [details]
Proposed patch
Comment 2 Nick Clifton 2014-10-28 11:54:57 UTC
Hi Klemensbaum,

  Please could you try out the uploaded patch and let me know if it resolves the issues for you ?

Cheers
  Nick