PR23147, Heap buffer overflow in pe_print_idata

Alan Modra amodra@gmail.com
Wed May 9 04:49:00 GMT 2018


	PR 23147
	* peXXigen.c (pe_print_idata): Bound check hint_addr.

diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index 5e0acc4571..b32cc18681 100644
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -1438,7 +1438,7 @@ pe_print_idata (bfd * abfd, void * vfile)
       if (hint_addr == 0)
 	hint_addr = first_thunk;
 
-      if (hint_addr != 0)
+      if (hint_addr != 0 && hint_addr - adj < datasize)
 	{
 	  bfd_byte *ft_data;
 	  asection *ft_section;

-- 
Alan Modra
Australia Development Lab, IBM



More information about the Binutils mailing list