Imagelibrary/binutils-gdb
1
0
Fork 1
mirror of https://github.com/bminor/binutils-gdb.git synced 2025-11-16 04:24:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

ctf-archive sanity checks

Browse Source 
Existing code checks that the first uint64_t ctfa_magic field is
available before reading but neglects to check that the last uint64_t
ctfa_ctfs is available before reading it in ctf_arc_bufpreamble.
ctf_arc_bufopen sets up a pointer to the struct ctf_archive in
ctf_new_archive_internal.  Extend the check to cover the entire struct.

	PR 33548
	PR 33549
	* ctf-archive.c (ctf_arc_bufpreamble, ctf_arc_bufopen): Check
	that buffer contains at least an entire struct ctf_archive
	when accessing such a struct.
This commit is contained in:
Alan Modra
2025-11-03 13:01:42 +10:30
parent c2a2bab96b
commit 626360da44
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libctf/ctf-archive.c
View File

@@ -395,7 +395,7 @@ const ctf_preamble_t *
ctf_arc_bufpreamble (const ctf_sect_t *ctfsect) ctf_arc_bufpreamble (const ctf_sect_t *ctfsect)
{ {
if (ctfsect->cts_data != NULL if (ctfsect->cts_data != NULL
&& ctfsect->cts_size > sizeof (uint64_t) && ctfsect->cts_size >= sizeof (struct ctf_archive)
&& (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC)) && (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
{ {
struct ctf_archive *arc = (struct ctf_archive *) ctfsect->cts_data; struct ctf_archive *arc = (struct ctf_archive *) ctfsect->cts_data;
@@ -418,7 +418,7 @@ ctf_arc_bufopen (const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
ctf_dict_t *fp = NULL; ctf_dict_t *fp = NULL;
if (ctfsect->cts_data != NULL if (ctfsect->cts_data != NULL
&& ctfsect->cts_size > sizeof (uint64_t) && ctfsect->cts_size >= sizeof (struct ctf_archive)
&& (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC)) && (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
{ {
/* The archive is mmappable, so this operation is trivial. /* The archive is mmappable, so this operation is trivial.