[binutils-gdb] Prevent illegal memory access when processing COFF auxillary symbol information.

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e

commit 334d4ced42d3d54a70a19f1323ff41c5a5f4ff5e
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu Aug 23 11:45:38 2018 +0100

    Prevent illegal memory access when processing COFF auxillary symbol information.
    
    	PR 23061
    	* coffgen.c (coff_pointerize_aux): Add table_end parameter.  Use
    	it to prevent walking off the end of the table.
    	(coff_get_normalized_symtab): Pass internal_end pointer to
    	coff_pointerize_aux.

Diff:
---
 bfd/ChangeLog |  8 ++++++++
 bfd/coffgen.c | 13 +++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index f24ef2b..ae37424 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,11 @@
+2018-08-23  Nick Clifton  <nickc@redhat.com>
+
+	PR 23061
+	* coffgen.c (coff_pointerize_aux): Add table_end parameter.  Use
+	it to prevent walking off the end of the table.
+	(coff_get_normalized_symtab): Pass internal_end pointer to
+	coff_pointerize_aux.
+
 2018-08-23  Alan Modra  <amodra@gmail.com>
 
 	* elf64-ppc.c (ppc64_elf_relocate_section): Don't miss clearing
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b9e4872..9e62feb 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1521,7 +1521,8 @@ coff_pointerize_aux (bfd *abfd,
 		     combined_entry_type *table_base,
 		     combined_entry_type *symbol,
 		     unsigned int indaux,
-		     combined_entry_type *auxent)
+		     combined_entry_type *auxent,
+		     combined_entry_type *table_end)
 {
   unsigned int type = symbol->u.syment.n_type;
   unsigned int n_sclass = symbol->u.syment.n_sclass;
@@ -1549,16 +1550,20 @@ coff_pointerize_aux (bfd *abfd,
        || n_sclass == C_FCN)
       && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0
       && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l
-      < (long) obj_raw_syment_count (abfd))
+      < (long) obj_raw_syment_count (abfd)
+      && table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l
+      < table_end)
     {
       auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.p =
 	table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l;
       auxent->fix_end = 1;
     }
+
   /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
      generate one, so we must be careful to ignore it.  */
   if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
-      < obj_raw_syment_count (abfd))
+      < obj_raw_syment_count (abfd)
+      && table_base + auxent->u.auxent.x_sym.x_tagndx.l < table_end)
     {
       auxent->u.auxent.x_sym.x_tagndx.p =
 	table_base + auxent->u.auxent.x_sym.x_tagndx.l;
@@ -1869,7 +1874,7 @@ coff_get_normalized_symtab (bfd *abfd)
 
 	  internal_ptr->is_sym = FALSE;
 	  coff_pointerize_aux (abfd, internal, symbol_ptr, i,
-			       internal_ptr);
+			       internal_ptr, internal_end);
 	}
     }