This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
Patch to detect invalid mergeable string sections
- From: "Joseph S. Myers" <joseph at codesourcery dot com>
- To: binutils at sourceware dot org
- Date: Tue, 30 Oct 2007 16:10:18 +0000 (UTC)
- Subject: Patch to detect invalid mergeable string sections
GCC versions before 4.1.2 could generate object files with invalid
mergeable string sections containing unterminated strings. This was
fixed by:
2006-06-21 Jakub Jelinek <jakub@redhat.com>
* varasm.c (mergeable_string_section): Check for embedded NULs and
NUL termination in the first int_size_in_bytes (TREE_TYPE (decl))
rather than TREE_STRING_LENGTH bytes.
When linking such object files, the linker can give internal errors
from _bfd_merged_section_offset (or possibly fail in other ways;
looking for the end of such a string will run off the end of the
section and start reading uninitialized memory). Invalid input should
never cause internal errors from the linker; it should give normal
non-internal errors to the user diagnosing the invalid input instead.
This patch adds a check that the strings found in such sections in
input files do not run off the end of their sections. A failure at
this point in turn requires two other checks for NULL secinfo to be
inserted so later stages in the attempted merging don't dereference a
NULL pointer. Tested on i686-pc-linux-gnu (native). OK to commit?
bfd:
2007-10-30 Joseph Myers <joseph@codesourcery.com>
* merge.c (sec_merge_hash_lookup): Add parameter sec_end. Check
for unterminated strings. All callers changed.
(_bfd_write_merged_section, _bfd_merged_section_offset): Handle
NULL secinfo from merge failures.
ld/testsuite:
2007-10-30 Joseph Myers <joseph@codesourcery.com>
* ld-elf/merge3.d, ld-elf/merge3.s: New.
Index: bfd/merge.c
===================================================================
RCS file: /cvs/src/src/bfd/merge.c,v
retrieving revision 1.33
diff -u -r1.33 merge.c
--- bfd/merge.c 19 Sep 2007 12:08:34 -0000 1.33
+++ bfd/merge.c 30 Oct 2007 16:00:19 -0000
@@ -133,6 +133,7 @@
static struct sec_merge_hash_entry *
sec_merge_hash_lookup (struct sec_merge_hash *table, const char *string,
+ const unsigned char *sec_end,
unsigned int alignment, bfd_boolean create)
{
register const unsigned char *s;
@@ -154,6 +155,12 @@
hash += c + (c << 17);
hash ^= hash >> 2;
++len;
+ if (sec_end && s >= sec_end)
+ {
+ (*_bfd_error_handler)
+ (_("unterminated string in section marked for merging"));
+ return NULL;
+ }
}
hash += len + (len << 17);
}
@@ -161,6 +168,12 @@
{
for (;;)
{
+ if (sec_end && s + table->entsize > sec_end)
+ {
+ (*_bfd_error_handler)
+ (_("unterminated string in section marked for merging"));
+ return NULL;
+ }
for (i = 0; i < table->entsize; ++i)
if (s[i] != '\0')
break;
@@ -264,7 +277,9 @@
{
register struct sec_merge_hash_entry *entry;
- entry = sec_merge_hash_lookup (tab, str, alignment, TRUE);
+ entry = sec_merge_hash_lookup (tab, str,
+ secinfo->contents + secinfo->sec->size,
+ alignment, TRUE);
if (entry == NULL)
return NULL;
@@ -779,6 +794,9 @@
secinfo = (struct sec_merge_sec_info *) psecinfo;
+ if (!secinfo)
+ return FALSE;
+
if (secinfo->first_str == NULL)
return TRUE;
@@ -807,6 +825,9 @@
secinfo = (struct sec_merge_sec_info *) psecinfo;
+ if (!secinfo)
+ return 0;
+
if (offset >= sec->rawsize)
{
if (offset > sec->rawsize)
@@ -849,7 +870,7 @@
{
p = secinfo->contents + (offset / sec->entsize) * sec->entsize;
}
- entry = sec_merge_hash_lookup (secinfo->htab, (char *) p, 0, FALSE);
+ entry = sec_merge_hash_lookup (secinfo->htab, (char *) p, NULL, 0, FALSE);
if (!entry)
{
if (! secinfo->htab->strings)
Index: ld/testsuite/ld-elf/merge3.d
===================================================================
RCS file: ld/testsuite/ld-elf/merge3.d
diff -N ld/testsuite/ld-elf/merge3.d
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ ld/testsuite/ld-elf/merge3.d 30 Oct 2007 16:00:20 -0000
@@ -0,0 +1,3 @@
+#source: merge3.s
+#ld: -T merge.ld
+#error: unterminated string in section marked for merging
Index: ld/testsuite/ld-elf/merge3.s
===================================================================
RCS file: ld/testsuite/ld-elf/merge3.s
diff -N ld/testsuite/ld-elf/merge3.s
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ ld/testsuite/ld-elf/merge3.s 30 Oct 2007 16:00:20 -0000
@@ -0,0 +1,7 @@
+ .section .rodata.str,"aMS","progbits",1
+.LC0:
+ .ascii "abcd"
+ .text
+ .global _start
+_start:
+ .long .LC0
--
Joseph S. Myers
joseph@codesourcery.com