[binutils-gdb] windres: buffer overflow

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4aaf663ded55a029f02f83952c0e96e6b1dd4e8d

commit 4aaf663ded55a029f02f83952c0e96e6b1dd4e8d
Author: Alan Modra <amodra@gmail.com>
Date:   Thu May 8 09:20:23 2025 +0930

    windres: buffer overflow
    
    bin_to_res_menuexitems can be called with random data offsets (and thus
    remaining lengths), confusing code that expects 4-byte aligned data.
    Prevent an item length adjustment for alignment exceeding the
    remaining length and then overflowing.

Diff:
---
 binutils/resbin.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/binutils/resbin.c b/binutils/resbin.c
index 01046ec3f91..3bce84f6766 100644
--- a/binutils/resbin.c
+++ b/binutils/resbin.c
@@ -433,6 +433,11 @@ bin_to_res_menuexitems (windres_bfd *wrbfd, const bfd_byte *data,
 
       itemlen = 14 + slen * 2 + 2;
       itemlen = (itemlen + 3) &~ 3;
+      /* Don't allow rounding up of itemlen to exceed length.  This
+	 is an anti-fuzzer measure to cope with unexpected offsets and
+	 lengths.   */
+      if (itemlen > length)
+	itemlen = length;
 
       if ((flags & 1) == 0)
 	{