GNU Binutils with patches for OS216
| 修訂 | 38e64b0ecc7f4ee64a02514b8d532782ac057fa2 (tree) |
|---|---|
| 時間 | 2018-01-25 20:35:10 |
| 作者 | Alan Modra <amodra@gmai...> |
| Commiter | Alan Modra |
PR22746, crash when running 32-bit objdump on corrupted file
Avoid unsigned int overflow by performing bfd_size_type multiplication.
PR 22746
* elfcode.h (elf_object_p): Avoid integer overflow.
bfd/ChangeLog (diff)
bfd/elfcode.h (diff)| @@ -1,3 +1,8 @@ | ||
| 1 | +2018-01-25 Alan Modra <amodra@gmail.com> | |
| 2 | + | |
| 3 | + PR 22746 | |
| 4 | + * elfcode.h (elf_object_p): Avoid integer overflow. | |
| 5 | + | |
| 1 | 6 | 2018-01-25 Eric Botcazou <ebotcazou@adacore.com> |
| 2 | 7 | |
| 3 | 8 | PR ld/22727 |
| @@ -680,7 +680,7 @@ elf_object_p (bfd *abfd) | ||
| 680 | 680 | if (i_ehdrp->e_shnum > ((bfd_size_type) -1) / sizeof (*i_shdrp)) |
| 681 | 681 | goto got_wrong_format_error; |
| 682 | 682 | #endif |
| 683 | - amt = sizeof (*i_shdrp) * i_ehdrp->e_shnum; | |
| 683 | + amt = sizeof (*i_shdrp) * (bfd_size_type) i_ehdrp->e_shnum; | |
| 684 | 684 | i_shdrp = (Elf_Internal_Shdr *) bfd_alloc (abfd, amt); |
| 685 | 685 | if (!i_shdrp) |
| 686 | 686 | goto got_no_match; |
| @@ -776,7 +776,7 @@ elf_object_p (bfd *abfd) | ||
| 776 | 776 | if (i_ehdrp->e_phnum > ((bfd_size_type) -1) / sizeof (*i_phdr)) |
| 777 | 777 | goto got_wrong_format_error; |
| 778 | 778 | #endif |
| 779 | - amt = i_ehdrp->e_phnum * sizeof (*i_phdr); | |
| 779 | + amt = (bfd_size_type) i_ehdrp->e_phnum * sizeof (*i_phdr); | |
| 780 | 780 | elf_tdata (abfd)->phdr = (Elf_Internal_Phdr *) bfd_alloc (abfd, amt); |
| 781 | 781 | if (elf_tdata (abfd)->phdr == NULL) |
| 782 | 782 | goto got_no_match; |
alaskanemily
Fork