diff options
| author |   Nick Clifton <nickc@redhat.com> | 2019-02-20 17:03:47 +0000 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2019-06-03 07:42:57 +0200 |
| commit | 4964a5671858f1e1518470dce9f6a47324f60e8f (patch) | |
| tree | 2cb9c274db15bf6533c10f7e525578667f33d0e5 | |
| parent | Automatic date update in version.in (diff) | |
| download | binutils-gdb-4964a5671858f1e1518470dce9f6a47324f60e8f.tar.gz binutils-gdb-4964a5671858f1e1518470dce9f6a47324f60e8f.tar.bz2 binutils-gdb-4964a5671858f1e1518470dce9f6a47324f60e8f.zip | |
Fix a illegal memory access fault when parsing a corrupt MIPS option section using readelf.
PR 24243
* readelf.c (process_mips_specific): Check for an options section
that is too small to even contain a single option.
(cherry picked from commit 7fc0c668f2aceb8582d74db1ad2528e2bba8a921)
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
| -rw-r--r-- | binutils/readelf.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/binutils/readelf.c b/binutils/readelf.c index b13eb6a43ba..8be228193e8 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -16178,6 +16178,12 @@ process_mips_specific (Filedata * filedata) error (_("No MIPS_OPTIONS header found\n")); return FALSE; } + /* PR 24243 */ + if (sect->sh_size < sizeof (* eopt)) + { + error (_("The MIPS options section is too small.\n")); + return FALSE; + } eopt = (Elf_External_Options *) get_data (NULL, filedata, options_offset, 1, sect->sh_size, _("options")); |