[binutils-gdb] asan: buffer overflow in elfnn-aarch64.c get_plt_type

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8ef22662dcd18c6b069fee3b1a10557cb2c03af4

commit 8ef22662dcd18c6b069fee3b1a10557cb2c03af4
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Dec 17 12:19:54 2021 +1030

    asan: buffer overflow in elfnn-aarch64.c get_plt_type
    
    We can't assume .dynamic is a multiple of ElfNN_External_Dyn, at least
    not when presented with fuzzed object files.
    
            * elfnn-aarch64.c (get_plt_type): Don't access past end of
            improperly sized .dynamic.

Diff:
---
 bfd/elfnn-aarch64.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/bfd/elfnn-aarch64.c b/bfd/elfnn-aarch64.c
index 4885f417a2a..051aff5c1b0 100644
--- a/bfd/elfnn-aarch64.c
+++ b/bfd/elfnn-aarch64.c
@@ -9762,11 +9762,13 @@ get_plt_type (bfd *abfd)
   aarch64_plt_type ret = PLT_NORMAL;
   bfd_byte *contents, *extdyn, *extdynend;
   asection *sec = bfd_get_section_by_name (abfd, ".dynamic");
-  if (!sec || !bfd_malloc_and_get_section (abfd, sec, &contents))
+  if (!sec
+      || sec->size < sizeof (ElfNN_External_Dyn)
+      || !bfd_malloc_and_get_section (abfd, sec, &contents))
     return ret;
   extdyn = contents;
-  extdynend = contents + sec->size;
-  for (; extdyn < extdynend; extdyn += sizeof (ElfNN_External_Dyn))
+  extdynend = contents + sec->size - sizeof (ElfNN_External_Dyn);
+  for (; extdyn <= extdynend; extdyn += sizeof (ElfNN_External_Dyn))
     {
       Elf_Internal_Dyn dyn;
       bfd_elfNN_swap_dyn_in (abfd, extdyn, &dyn);