blob: 0bb95ad56fcb603a50df4fffa4c1a961ad285501 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
From 7e1e19887abd24aeb15066b141cdff5541e0ec8e Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Mon, 27 Oct 2014 14:45:06 +0000
Subject: [PATCH] Fix a seg-fault in strings and other binutuils when parsing a corrupt PE
executable with an invalid value in the NumberOfRvaAndSizes field of the
AOUT header.
PR binutils/17512
* peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries
with an invalid value for NumberOfRvaAndSizes.
---
bfd/ChangeLog | 4 ++++
bfd/peXXigen.c | 12 ++++++++++++
2 files changed, 16 insertions(+), 0 deletions(-)
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 7ba4431..e1d9379 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,9 @@
2014-10-27 Nick Clifton <nickc@redhat.com>
+ PR binutils/17512
+ * peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries
+ with an invalid value for NumberOfRvaAndSizes.
+
PR binutils/17510
* elf.c (setup_group): Improve handling of corrupt group
sections.
diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index 2fb631c..987be40 100644
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -504,6 +504,18 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd,
{
int idx;
+ /* PR 17512: Corrupt PE binaries can cause seg-faults. */
+ if (a->NumberOfRvaAndSizes > 16)
+ {
+ (*_bfd_error_handler)
+ (_("%B: aout header specifies an invalid number of data-directory entries: %d"),
+ abfd, a->NumberOfRvaAndSizes);
+ /* Paranoia: If the number is corrupt, then assume that the
+ actual entries themselves might be corrupt as well. */
+ a->NumberOfRvaAndSizes = 0;
+ }
+
+
for (idx = 0; idx < a->NumberOfRvaAndSizes; idx++)
{
/* If data directory is empty, rva also should be 0. */
--
1.7.1
|
