[binutils-gdb] bus error with fuzzed archive element

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c7a1fe2286e6f68c8bd0cef12feca4ade2451a25

commit c7a1fe2286e6f68c8bd0cef12feca4ade2451a25
Author: Alan Modra <amodra@gmail.com>
Date:   Sat May 4 19:15:49 2024 +0930

    bus error with fuzzed archive element
    
            * libbfd.c (bfd_mmap_local): Sanity check rsize against actual
            file offset and size, not an archive element offset and size.

Diff:
---
 bfd/libbfd.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index 747b69ec2c6..53868471001 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -1072,7 +1072,18 @@ static void *
 bfd_mmap_local (bfd *abfd, size_t rsize, int prot, void **map_addr,
 		size_t *map_size)
 {
-  ufile_ptr filesize = bfd_get_file_size (abfd);
+  /* We mmap on the underlying file.  In an archive it might be nice
+     to limit RSIZE to the element size, but that can be fuzzed and
+     the offset returned by bfd_tell is relative to the start of the
+     element.  Therefore to reliably stop access beyond the end of a
+     file (and resulting bus errors) we must work with the underlying
+     file offset and size, and trust that callers will limit access to
+     within an archive element.  */
+  while (abfd->my_archive != NULL
+	 && !bfd_is_thin_archive (abfd->my_archive))
+    abfd = abfd->my_archive;
+
+  ufile_ptr filesize = bfd_get_size (abfd);
   ufile_ptr offset = bfd_tell (abfd);
   if (filesize < offset || filesize - offset < rsize)
     {