This is the mail archive of the
binutils-cvs@sourceware.org
mailing list for the binutils project.
[binutils-gdb/binutils-2_26-branch] Prevent looping in archives
- From: Alan Modra <amodra at sourceware dot org>
- To: bfd-cvs at sourceware dot org
- Date: 10 Dec 2015 13:49:44 -0000
- Subject: [binutils-gdb/binutils-2_26-branch] Prevent looping in archives
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4f3b24796c19965c348064c285d9d031afb3520d
commit 4f3b24796c19965c348064c285d9d031afb3520d
Author: Alan Modra <amodra@gmail.com>
Date: Wed Nov 18 22:12:23 2015 +1030
Prevent looping in archives
PR 19256
* archive.c (bfd_generic_openr_next_archived_file): Don't allow
backward file movement via "negative" sizes.
* coff-alpha.c (alpha_ecoff_openr_next_archived_file): Likewise.
Diff:
---
bfd/ChangeLog | 9 +++++++++
bfd/archive.c | 24 ++++++++++++++++--------
bfd/coff-alpha.c | 8 +++++++-
3 files changed, 32 insertions(+), 9 deletions(-)
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 7b2dd0a..80a5b2d 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,12 @@
+2015-12-10 Alan Modra <amodra@gmail.com>
+
+ Apply from master.
+ 2015-11-18 Alan Modra <amodra@gmail.com>
+ PR 19256
+ * archive.c (bfd_generic_openr_next_archived_file): Don't allow
+ backward file movement via "negative" sizes.
+ * coff-alpha.c (alpha_ecoff_openr_next_archived_file): Likewise.
+
2015-12-04 H.J. Lu <hongjiu.lu@intel.com>
* elf32-i386.c (elf_i386_convert_load): Skip if addend isn't 0.
diff --git a/bfd/archive.c b/bfd/archive.c
index 1715474..b3d03d3 100644
--- a/bfd/archive.c
+++ b/bfd/archive.c
@@ -786,21 +786,29 @@ bfd_openr_next_archived_file (bfd *archive, bfd *last_file)
bfd *
bfd_generic_openr_next_archived_file (bfd *archive, bfd *last_file)
{
- file_ptr filestart;
+ ufile_ptr filestart;
if (!last_file)
filestart = bfd_ardata (archive)->first_file_filepos;
else
{
- bfd_size_type size = arelt_size (last_file);
-
filestart = last_file->proxy_origin;
if (! bfd_is_thin_archive (archive))
- filestart += size;
- /* Pad to an even boundary...
- Note that last_file->origin can be odd in the case of
- BSD-4.4-style element with a long odd size. */
- filestart += filestart % 2;
+ {
+ bfd_size_type size = arelt_size (last_file);
+
+ filestart += size;
+ /* Pad to an even boundary...
+ Note that last_file->origin can be odd in the case of
+ BSD-4.4-style element with a long odd size. */
+ filestart += filestart % 2;
+ if (filestart <= last_file->proxy_origin)
+ {
+ /* Prevent looping. See PR19256. */
+ bfd_set_error (bfd_error_malformed_archive);
+ return NULL;
+ }
+ }
}
return _bfd_get_elt_at_filepos (archive, filestart);
diff --git a/bfd/coff-alpha.c b/bfd/coff-alpha.c
index 58d4e1d..7478f2f 100644
--- a/bfd/coff-alpha.c
+++ b/bfd/coff-alpha.c
@@ -2187,7 +2187,7 @@ alpha_ecoff_get_elt_at_filepos (bfd *archive, file_ptr filepos)
static bfd *
alpha_ecoff_openr_next_archived_file (bfd *archive, bfd *last_file)
{
- file_ptr filestart;
+ ufile_ptr filestart;
if (last_file == NULL)
filestart = bfd_ardata (archive)->first_file_filepos;
@@ -2208,6 +2208,12 @@ alpha_ecoff_openr_next_archived_file (bfd *archive, bfd *last_file)
BSD-4.4-style element with a long odd size. */
filestart = last_file->proxy_origin + size;
filestart += filestart % 2;
+ if (filestart <= last_file->proxy_origin)
+ {
+ /* Prevent looping. See PR19256. */
+ bfd_set_error (bfd_error_malformed_archive);
+ return NULL;
+ }
}
return alpha_ecoff_get_elt_at_filepos (archive, filestart);