XCOFF uninitialized read

Message ID 20200320020854.GI4583@bubble.grove.modra.org
State New
Headers show
Series
  • XCOFF uninitialized read
Related show

Commit Message

Stefan Schulze Frielinghaus via Binutils March 20, 2020, 2:08 a.m.
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Ensure size is large
	enough to read number of symbols.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c
index 2dd68e08c3..bf87596a4f 100644
--- a/bfd/coff-rs6000.c
+++ b/bfd/coff-rs6000.c
@@ -1260,9 +1260,9 @@  _bfd_xcoff_slurp_armap (bfd *abfd)
 	return FALSE;
 
       GET_VALUE_IN_FIELD (sz, hdr.size, 10);
-      if (sz == (bfd_size_type) -1)
+      if (sz + 1 < 5)
 	{
-	  bfd_set_error (bfd_error_no_memory);
+	  bfd_set_error (bfd_error_bad_value);
 	  return FALSE;
 	}
 
@@ -1322,9 +1322,9 @@  _bfd_xcoff_slurp_armap (bfd *abfd)
 	return FALSE;
 
       GET_VALUE_IN_FIELD (sz, hdr.size, 10);
-      if (sz == (bfd_size_type) -1)
+      if (sz + 1 < 9)
 	{
-	  bfd_set_error (bfd_error_no_memory);
+	  bfd_set_error (bfd_error_bad_value);
 	  return FALSE;
 	}