asan: readelf: use after free in process_archive

Message ID 20200627033321.GZ21885@bubble.grove.modra.org
State New
Headers show
Series
  • asan: readelf: use after free in process_archive
Related show

Commit Message

Alan Modra via Binutils June 27, 2020, 3:33 a.m.
This tidies up in cases where fuzzed thin archives hit the error return
path in setup_nested_archive.

	* elfcomm.c (setup_nested_archive): Set nested_arch->file to NULL
	after freeing.
	(release_archive): Set fields of arch to NULL after freeing.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/binutils/elfcomm.c b/binutils/elfcomm.c
index 558afa7d05..37f9dbe7ee 100644
--- a/binutils/elfcomm.c
+++ b/binutils/elfcomm.c
@@ -727,7 +727,10 @@  setup_nested_archive (struct archive_info *nested_arch,
 
   /* Close previous file and discard cached information.  */
   if (nested_arch->file != NULL)
-    fclose (nested_arch->file);
+    {
+      fclose (nested_arch->file);
+      nested_arch->file = NULL;
+    }
   release_archive (nested_arch);
 
   member_file = fopen (member_file_name, "rb");
@@ -748,6 +751,10 @@  release_archive (struct archive_info * arch)
   free (arch->index_array);
   free (arch->sym_table);
   free (arch->longnames);
+  arch->file_name = NULL;
+  arch->index_array = NULL;
+  arch->sym_table = NULL;
+  arch->longnames = NULL;
 }
 
 /* Get the name of an archive member from the current archive header.