提交: b0029dce6867de1a2828293177b0e030d2f0f03c - binutils_os216 (git)

GNU Binutils with patches for OS216

Commit MetaInfo

• 修訂: b0029dce6867de1a2828293177b0e030d2f0f03c (tree)
• 時間: 2017-11-29 03:00:29
• 作者: Nick Clifton <nickc@redh...>
• Commiter: Nick Clifton

Log Message

Prevent a memory exhaustion problem when trying to read in strings from a COFF binary with a corrupt string table size.

PR 22507
* coffgen.c (_bfd_coff_read_string_table): Check for an excessive
size of the external string table.

Change Summary

• modified: bfd/ChangeLog
• modified: bfd/coffgen.c

差異

--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,11 @@
 2017-11-28  Nick Clifton  <[e-mail]>
 
+	PR 22507
+	* coffgen.c (_bfd_coff_read_string_table): Check for an excessive
+	size of the external string table.
+
[phone]  Nick Clifton  <[e-mail]>
+
 	PR 22506
 	* reloc.c (reloc_offset_in_range): Rename to
 	bfd_reloc_offset_in_range and export.

--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1718,7 +1718,7 @@ _bfd_coff_read_string_table (bfd *abfd)
 #endif
     }
 
-  if (strsize < STRING_SIZE_SIZE)
+  if (strsize < STRING_SIZE_SIZE || strsize > bfd_get_file_size (abfd))
     {
       _bfd_error_handler
 	/* xgettext: c-format */
@@ -1726,7 +1726,7 @@ _bfd_coff_read_string_table (bfd *abfd)
       bfd_set_error (bfd_error_bad_value);
       return NULL;
     }
-
+  
   strings = (char *) bfd_malloc (strsize + 1);
   if (strings == NULL)
     return NULL;