diff options
| author |   Nick Clifton <nickc@redhat.com> | 2018-11-30 11:43:12 +0000 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2019-04-06 14:56:43 +0200 |
| commit | a0e946d18b83a3445fa903d86172d2c8359cdfa9 (patch) | |
| tree | 7bd414ebf714a7101ef4d14e145cb1255835caf0 | |
| parent | Fix a memory exhaustion bug when attempting to allocate room for an impossibl... (diff) | |
| download | binutils-gdb-a0e946d18b83a3445fa903d86172d2c8359cdfa9.tar.gz binutils-gdb-a0e946d18b83a3445fa903d86172d2c8359cdfa9.tar.bz2 binutils-gdb-a0e946d18b83a3445fa903d86172d2c8359cdfa9.zip | |
Remove an abort in the bfd library and add a check for an integer overflow when mapping sections to segments.
PR 23932
* elf.c (IS_CONTAINED_BY_LMA): Add a check for a negative section
size.
(rewrite_elf_program_header): If no sections are mapped into a
segment return an error.
(cherry picked from commit beab453223769279cc1cef68a1622ab8978641f7)
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
| -rw-r--r-- | bfd/elf.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/bfd/elf.c b/bfd/elf.c index 828241d48af..ce50c252bf3 100644 --- a/bfd/elf.c +++ b/bfd/elf.c @@ -6592,6 +6592,7 @@ rewrite_elf_program_header (bfd *ibfd, bfd *obfd) the given segment. LMA addresses are compared. */ #define IS_CONTAINED_BY_LMA(section, segment, base) \ (section->lma >= base \ + && (section->lma + SECTION_SIZE (section, segment) >= section->lma) \ && (section->lma + SECTION_SIZE (section, segment) \ <= SEGMENT_END (segment, base))) @@ -7114,7 +7115,15 @@ rewrite_elf_program_header (bfd *ibfd, bfd *obfd) suggested_lma = output_section; } - BFD_ASSERT (map->count > 0); + /* PR 23932. A corrupt input file may contain sections that cannot + be assigned to any segment - because for example they have a + negative size - or segments that do not contain any sections. */ + if (map->count == 0) + { + bfd_set_error (bfd_error_bad_value); + free (sections); + return FALSE; + } /* Add the current segment to the list of built segments. */ *pointer_to_map = map; |