diff options
Diffstat (limited to 'd/binutils/binutils-fix-seg-fault-in-strings-on-corrupt-pe.patch')
| -rw-r--r-- | d/binutils/binutils-fix-seg-fault-in-strings-on-corrupt-pe.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/d/binutils/binutils-fix-seg-fault-in-strings-on-corrupt-pe.patch b/d/binutils/binutils-fix-seg-fault-in-strings-on-corrupt-pe.patch new file mode 100644 index 0000000..0bb95ad --- /dev/null +++ b/d/binutils/binutils-fix-seg-fault-in-strings-on-corrupt-pe.patch @@ -0,0 +1,55 @@ +From 7e1e19887abd24aeb15066b141cdff5541e0ec8e Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Mon, 27 Oct 2014 14:45:06 +0000 +Subject: [PATCH] Fix a seg-fault in strings and other binutuils when parsing a corrupt PE + executable with an invalid value in the NumberOfRvaAndSizes field of the + AOUT header. + + PR binutils/17512 + * peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries + with an invalid value for NumberOfRvaAndSizes. +--- + bfd/ChangeLog | 4 ++++ + bfd/peXXigen.c | 12 ++++++++++++ + 2 files changed, 16 insertions(+), 0 deletions(-) + +diff --git a/bfd/ChangeLog b/bfd/ChangeLog +index 7ba4431..e1d9379 100644 +--- a/bfd/ChangeLog ++++ b/bfd/ChangeLog +@@ -1,5 +1,9 @@ + 2014-10-27 Nick Clifton <nickc@redhat.com> + ++ PR binutils/17512 ++ * peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries ++ with an invalid value for NumberOfRvaAndSizes. ++ + PR binutils/17510 + * elf.c (setup_group): Improve handling of corrupt group + sections. +diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c +index 2fb631c..987be40 100644 +--- a/bfd/peXXigen.c ++++ b/bfd/peXXigen.c +@@ -504,6 +504,18 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd, + { + int idx; + ++ /* PR 17512: Corrupt PE binaries can cause seg-faults. */ ++ if (a->NumberOfRvaAndSizes > 16) ++ { ++ (*_bfd_error_handler) ++ (_("%B: aout header specifies an invalid number of data-directory entries: %d"), ++ abfd, a->NumberOfRvaAndSizes); ++ /* Paranoia: If the number is corrupt, then assume that the ++ actual entries themselves might be corrupt as well. */ ++ a->NumberOfRvaAndSizes = 0; ++ } ++ ++ + for (idx = 0; idx < a->NumberOfRvaAndSizes; idx++) + { + /* If data directory is empty, rva also should be 0. */ +-- +1.7.1 + |