Toolchain/binutils-gdb
1
0
Fork 0
forked from Imagelibrary/binutils-gdb
Code Pull Requests Activity

bus error with fuzzed archive element

Browse Source 
* libbfd.c (bfd_mmap_local): Sanity check rsize against actual
	file offset and size, not an archive element offset and size.
This commit is contained in:
Alan Modra
2024-05-04 19:15:49 +09:30
parent c479e964a8
commit c7a1fe2286
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
bfd/libbfd.c
View File

@@ -1072,7 +1072,18 @@ static void *
bfd_mmap_local (bfd *abfd, size_t rsize, int prot, void **map_addr, bfd_mmap_local (bfd *abfd, size_t rsize, int prot, void **map_addr,
size_t *map_size) size_t *map_size)
{ {
ufile_ptr filesize = bfd_get_file_size (abfd); /* We mmap on the underlying file. In an archive it might be nice
to limit RSIZE to the element size, but that can be fuzzed and
the offset returned by bfd_tell is relative to the start of the
element. Therefore to reliably stop access beyond the end of a
file (and resulting bus errors) we must work with the underlying
file offset and size, and trust that callers will limit access to
within an archive element. */
while (abfd->my_archive != NULL
&& !bfd_is_thin_archive (abfd->my_archive))
abfd = abfd->my_archive;
ufile_ptr filesize = bfd_get_size (abfd);
ufile_ptr offset = bfd_tell (abfd); ufile_ptr offset = bfd_tell (abfd);
if (filesize < offset || filesize - offset < rsize) if (filesize < offset || filesize - offset < rsize)
{ {