This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
PR24689, string table corruption
- From: Alan Modra <amodra at gmail dot com>
- To: binutils at sourceware dot org
- Date: Fri, 21 Jun 2019 16:45:00 +0930
- Subject: PR24689, string table corruption
The testcase in the PR had a e_shstrndx section of type SHT_GROUP.
hdr->contents were initialized by setup_group rather than being read
from the file, thus last byte was not zero and string dereference ran
off the end of the buffer.
PR 24689
* elfcode.h (elf_object_p): Check type of e_shstrndx section.
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
index a0487b0843..5180f79a74 100644
--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
@@ -754,7 +754,8 @@ elf_object_p (bfd *abfd)
/* A further sanity check. */
if (i_ehdrp->e_shnum != 0)
{
- if (i_ehdrp->e_shstrndx >= elf_numsections (abfd))
+ if (i_ehdrp->e_shstrndx >= elf_numsections (abfd)
+ || i_shdrp[i_ehdrp->e_shstrndx].sh_type != SHT_STRTAB)
{
/* PR 2257:
We used to just goto got_wrong_format_error here
--
Alan Modra
Australia Development Lab, IBM