PR25961, buffer overflow in coff_swap_aux_in

Message ID 20200511084315.GR27573@bubble.grove.modra.org
State New
Headers show
Series
  • PR25961, buffer overflow in coff_swap_aux_in
Related show

Commit Message

PR 25961
	* coffgen.c (coff_get_normalized_symtab): Check that buffer
	contains required number of auxents before processing any auxent.
	* coffswap.h (coff_swap_aux_in <C_FILE>): Only swap in extended
	file name from auxents for PE.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index 6d84d51284..96140e0ad2 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1818,6 +1818,13 @@  coff_get_normalized_symtab (bfd *abfd)
       symbol_ptr = internal_ptr;
       internal_ptr->is_sym = TRUE;
 
+      /* PR 17512: Prevent buffer overrun.  */
+      if (symbol_ptr->u.syment.n_numaux > (raw_end - raw_src) / symesz)
+	{
+	  bfd_release (abfd, internal);
+	  return NULL;
+	}
+
       for (i = 0;
 	   i < symbol_ptr->u.syment.n_numaux;
 	   i++)
@@ -1825,13 +1832,6 @@  coff_get_normalized_symtab (bfd *abfd)
 	  internal_ptr++;
 	  raw_src += symesz;
 
-	  /* PR 17512: Prevent buffer overrun.  */
-	  if (raw_src >= raw_end || internal_ptr >= internal_end)
-	    {
-	      bfd_release (abfd, internal);
-	      return NULL;
-	    }
-
 	  bfd_coff_swap_aux_in (abfd, (void *) raw_src,
 				symbol_ptr->u.syment.n_type,
 				symbol_ptr->u.syment.n_sclass,
diff --git a/bfd/coffswap.h b/bfd/coffswap.h
index 7c0be22107..f75001e0d2 100644
--- a/bfd/coffswap.h
+++ b/bfd/coffswap.h
@@ -399,7 +399,7 @@  coff_swap_aux_in (bfd *abfd,
 #if FILNMLEN != E_FILNMLEN
 #error we need to cope with truncating or extending FILNMLEN
 #else
-	  if (numaux > 1)
+	  if (numaux > 1 && coff_data (abfd)->pe)
 	    {
 	      if (indx == 0)
 		memcpy (in->x_file.x_fname, ext->x_file.x_fname,