From e0ce6dde97881435d33652572789b94c846cacde Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Fri, 2 Jun 2023 08:21:36 +0930 Subject: Re: More ecoff sanity checks Another fix for fuzzed object files, exhibiting as a segfault in nm.c filter_symbols when accessing a symbol name. * ecoff.c (_bfd_ecoff_slurp_symbol_table): Sanity check fdr_ptr->issBase, and tighten sym.iss check. --- bfd/ecoff.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bfd/ecoff.c b/bfd/ecoff.c index 676b8d84017..f2930569f21 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -942,7 +942,9 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd) if (fdr_ptr->isymBase < 0 || fdr_ptr->isymBase > symhdr->isymMax || fdr_ptr->csym <= 0 - || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase) + || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase + || fdr_ptr->issBase < 0 + || fdr_ptr->issBase > symhdr->issMax) continue; lraw_src = ((char *) ecoff_data (abfd)->debug_info.external_sym + fdr_ptr->isymBase * external_sym_size); @@ -955,7 +957,7 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd) (*swap_sym_in) (abfd, (void *) lraw_src, &internal_sym); - if (internal_sym.iss >= symhdr->issMax + if (internal_sym.iss >= symhdr->issMax - fdr_ptr->issBase || internal_sym.iss < 0) { bfd_set_error (bfd_error_bad_value); -- cgit v1.2.3