|
| 1 | +From c2bf7de1eb77a91d7a3c86d56408bf57de540faf Mon Sep 17 00:00:00 2001 |
| 2 | +From: Alan Modra <amodra@gmail.com> |
| 3 | +Date: Sat, 28 Feb 2026 13:16:40 +1030 |
| 4 | +Subject: [PATCH] xcofflink buffer overflows |
| 5 | + |
| 6 | +This fixes two fuzzed object file out-of-bounds accesses. |
| 7 | + |
| 8 | + * xcofflink.c (xcoff_link_add_symbols): Properly bounds check |
| 9 | + XTY_LD x_scnlen index. Sanity check r_symndx before using it |
| 10 | + to index sym hashes. |
| 11 | +Conflict:NA |
| 12 | +Reference:https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=c2bf7de1eb77a91d7a3c86d56408bf57de540faf |
| 13 | +--- |
| 14 | + bfd/xcofflink.c | 10 ++++------ |
| 15 | + 1 file changed, 4 insertions(+), 6 deletions(-) |
| 16 | + |
| 17 | +--- binutils.orig/bfd/xcofflink.c |
| 18 | ++++ binutils/bfd/xcofflink.c |
| 19 | +@@ -1873,12 +1873,9 @@ xcoff_link_add_symbols (bfd *abfd, struc |
| 20 | + follow its appropriate XTY_SD symbol. The .set pseudo op can |
| 21 | + cause the XTY_LD to not follow the XTY_SD symbol. */ |
| 22 | + { |
| 23 | +- bool bad; |
| 24 | +- |
| 25 | +- bad = false; |
| 26 | +- if (aux.x_csect.x_scnlen.u64 |
| 27 | +- >= (size_t) (esym - (bfd_byte *) obj_coff_external_syms (abfd))) |
| 28 | +- bad = true; |
| 29 | ++ bool bad = (aux.x_csect.x_scnlen.u64 |
| 30 | ++ >= ((esym - (bfd_byte *) obj_coff_external_syms (abfd)) |
| 31 | ++ / symesz)); |
| 32 | + if (! bad) |
| 33 | + { |
| 34 | + section = xcoff_data (abfd)->csects[aux.x_csect.x_scnlen.u64]; |
| 35 | +@@ -2244,6 +2241,7 @@ xcoff_link_add_symbols (bfd *abfd, struc |
| 36 | + functions imported from dynamic objects. */ |
| 37 | + if (info->output_bfd->xvec == abfd->xvec |
| 38 | + && *rel_csect != bfd_und_section_ptr |
| 39 | ++ && (unsigned long) rel->r_symndx < obj_raw_syment_count (abfd) |
| 40 | + && obj_xcoff_sym_hashes (abfd)[rel->r_symndx] != NULL) |
| 41 | + { |
| 42 | + struct xcoff_link_hash_entry *h; |
0 commit comments