Fix memory access

Nick Clifton nickc@redhat.com
Fri Feb 17 11:39:00 GMT 2017


Hi Guys,

  The upgrade to version 1.2.10 of ZLIB has exposed a bug in the BFD
  library's code to decompressed section contents.  The code was lying
  to ZLIB about the size of the input buffer, and with the new, more
  efficient code in 1.2.10 this could result in an illegal memory
  access.

  I am applying the patch below to fix the problem.  Tested with no
  regressions on a large number of targets.

Cheers
  Nick

bfd/ChangeLog
2017-02-17  Nick Clifton  <nickc@redhat.com>

	* compress.c (bfd_get_full_section_contents): Remember to reduce
	compressed size by the sizeof the compression header when
	decompressing the contents.

diff --git a/bfd/compress.c b/bfd/compress.c
index 1ed7d74..f881c07 100644
--- a/bfd/compress.c
+++ b/bfd/compress.c
@@ -300,7 +300,7 @@ bfd_get_full_section_contents (bfd *abfd, sec_ptr sec, bfd_byte **ptr)
 	   SHF_COMPRESSED section.  */
 	compression_header_size = 12;
       if (!decompress_contents (compressed_buffer + compression_header_size,
-				sec->compressed_size, p, sz))
+				sec->compressed_size - compression_header_size, p, sz))
 	{
 	  bfd_set_error (bfd_error_bad_value);
 	  if (p != *ptr)



More information about the Binutils mailing list