Imagelibrary/binutils-gdb
1
0
Fork 1
mirror of https://github.com/bminor/binutils-gdb.git synced 2025-12-05 15:15:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

PR32663, ld buffer overflow reading .debug_info

Browse Source 
When reading debug info to print an error message, we'll be reading
the debug info off disk, not using edited debug info.  sec->rawsize
if non-zero is the correct size.

	PR 32663
	* dwarf2.c (_bfd_dwarf2_slurp_debug_info): Use
	bfd_get_section_limit_octets to properly size debug sections.
This commit is contained in:
Alan Modra
2025-02-09 20:15:02 +10:30
parent 38ee3a7664
commit 2c6e1a4cd3
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
bfd/dwarf2.c
View File

@@ -5513,7 +5513,7 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, bfd *debug_bfd,
if (! find_debug_info (debug_bfd, debug_sections, msec))
{
/* Case 1: only one info section. */
total_size = msec->size;
total_size = bfd_get_section_limit_octets (debug_bfd, msec);
if (! read_section (debug_bfd, &stash->debug_sections[debug_info],
symbols, 0,
&stash->f.dwarf_info_buffer, &total_size))
@@ -5528,13 +5528,14 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, bfd *debug_bfd,
{
if (bfd_section_size_insane (debug_bfd, msec))
goto restore_vma;
bfd_size_type readsz = bfd_get_section_limit_octets (debug_bfd, msec);
/* Catch PR25070 testcase overflowing size calculation here. */
if (total_size + msec->size < total_size)
if (total_size + readsz < total_size)
{
bfd_set_error (bfd_error_no_memory);
goto restore_vma;
}
total_size += msec->size;
total_size += readsz;
}
stash->f.dwarf_info_buffer = (bfd_byte *) bfd_malloc (total_size);
@@ -5546,10 +5547,8 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, bfd *debug_bfd,
msec;
msec = find_debug_info (debug_bfd, debug_sections, msec))
{
bfd_size_type size;
size = msec->size;
if (size == 0)
bfd_size_type readsz = bfd_get_section_limit_octets (debug_bfd, msec);
if (readsz == 0)
continue;
if (!(bfd_simple_get_relocated_section_contents
@@ -5557,7 +5556,7 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, bfd *debug_bfd,
symbols)))
goto restore_vma;
total_size += size;
total_size += readsz;
}
}