diff options
| author | Alan Modra <amodra@gmail.com> | 2023-06-02 08:21:36 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2023-06-02 09:41:49 +0930 |
| commit | e0ce6dde97881435d33652572789b94c846cacde (patch) | |
| tree | 1820321043b382162a61bfcb628489b42bc12c34 | |
| parent | 74a965d8e09217f3d8f8295c9126b77cdd62b798 (diff) | |
Re: More ecoff sanity checks
Another fix for fuzzed object files, exhibiting as a segfault in
nm.c filter_symbols when accessing a symbol name.
* ecoff.c (_bfd_ecoff_slurp_symbol_table): Sanity check
fdr_ptr->issBase, and tighten sym.iss check.
| -rw-r--r-- | bfd/ecoff.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/bfd/ecoff.c b/bfd/ecoff.c index 676b8d84017..f2930569f21 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -942,7 +942,9 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd) if (fdr_ptr->isymBase < 0 || fdr_ptr->isymBase > symhdr->isymMax || fdr_ptr->csym <= 0 - || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase) + || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase + || fdr_ptr->issBase < 0 + || fdr_ptr->issBase > symhdr->issMax) continue; lraw_src = ((char *) ecoff_data (abfd)->debug_info.external_sym + fdr_ptr->isymBase * external_sym_size); @@ -955,7 +957,7 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd) (*swap_sym_in) (abfd, (void *) lraw_src, &internal_sym); - if (internal_sym.iss >= symhdr->issMax + if (internal_sym.iss >= symhdr->issMax - fdr_ptr->issBase || internal_sym.iss < 0) { bfd_set_error (bfd_error_bad_value); |