This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
PR24336, buffer overflow in swap_reloca_in
- From: Alan Modra <amodra at gmail dot com>
- To: binutils at sourceware dot org
- Date: Fri, 15 Mar 2019 20:03:11 +1030
- Subject: PR24336, buffer overflow in swap_reloca_in
PR 24336
* elflink.c (elf_link_read_relocs_from_section): Handle fuzzed
object files with sh_size not a multiple of sh_entsize.
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 3413726b94..2600c3934b 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -2523,9 +2523,11 @@ elf_link_read_relocs_from_section (bfd *abfd,
}
erela = (const bfd_byte *) external_relocs;
- erelaend = erela + shdr->sh_size;
+ /* Setting erelaend like this and comparing with <= handles case of
+ a fuzzed object with sh_size not a multiple of sh_entsize. */
+ erelaend = erela + shdr->sh_size - shdr->sh_entsize;
irela = internal_relocs;
- while (erela < erelaend)
+ while (erela <= erelaend)
{
bfd_vma r_symndx;
--
Alan Modra
Australia Development Lab, IBM