Fix illegal memory accesses in readelf when parsing a corrupt binary.

[binutils-gdb.git] / binutils / readelf.c

diff --git a/binutils/readelf.c b/binutils/readelf.c
index a61befef3fbd92a8e392b81618d496f068433087..20df6f899609536adc50ca69fd4c3c84267c42f9 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -676,8 +676,14 @@ find_section_in_set (const char * name, unsigned int * set)
   if (set != NULL)
     {
       while ((i = *set++) > 0)
-       if (streq (SECTION_NAME (section_headers + i), name))
-         return section_headers + i;
+       {
+         /* See PR 21156 for a reproducer.  */
+         if (i >= elf_header.e_shnum)
+           continue; /* FIXME: Should we issue an error message ?  */
+
+         if (streq (SECTION_NAME (section_headers + i), name))
+           return section_headers + i;
+       }
     }
 
   return find_section (name);
@@ -4136,7 +4142,18 @@ get_section_type_name (unsigned int sh_type)
              if (elf_header.e_ident[EI_OSABI] == ELFOSABI_SOLARIS)
                result = get_solaris_section_type (sh_type);
              else
-               result = NULL;
+               {
+                 switch (sh_type)
+                   {
+                   case SHT_GNU_INCREMENTAL_INPUTS: result = "GNU_INCREMENTAL_INPUTS"; break;
+                   case SHT_GNU_ATTRIBUTES: result = "GNU_ATTRIBUTES"; break;
+                   case SHT_GNU_HASH: result = "GNU_HASH"; break;
+                   case SHT_GNU_LIBLIST: result = "GNU_LIBLIST"; break;
+                   default:
+                     result = NULL;
+                     break;
+                   }
+               }
              break;
            }
 
@@ -5715,12 +5732,18 @@ get_elf_section_flags (bfd_vma sh_flags)
 }
 
 static unsigned int
-get_compression_header (Elf_Internal_Chdr *chdr, unsigned char *buf)
+get_compression_header (Elf_Internal_Chdr *chdr, unsigned char *buf, bfd_size_type size)
 {
   if (is_32bit_elf)
     {
       Elf32_External_Chdr *echdr = (Elf32_External_Chdr *) buf;
 
+      if (size < sizeof (* echdr))
+       {
+         error (_("Compressed section is too small even for a compression header\n"));
+         return 0;
+       }
+
       chdr->ch_type = BYTE_GET (echdr->ch_type);
       chdr->ch_size = BYTE_GET (echdr->ch_size);
       chdr->ch_addralign = BYTE_GET (echdr->ch_addralign);
@@ -5730,6 +5753,12 @@ get_compression_header (Elf_Internal_Chdr *chdr, unsigned char *buf)
     {
       Elf64_External_Chdr *echdr = (Elf64_External_Chdr *) buf;
 
+      if (size < sizeof (* echdr))
+       {
+         error (_("Compressed section is too small even for a compression header\n"));
+         return 0;
+       }
+
       chdr->ch_type = BYTE_GET (echdr->ch_type);
       chdr->ch_size = BYTE_GET (echdr->ch_size);
       chdr->ch_addralign = BYTE_GET (echdr->ch_addralign);
@@ -6311,7 +6340,7 @@ process_section_headers (FILE * file)
                {
                  Elf_Internal_Chdr chdr;
 
-                 (void) get_compression_header (&chdr, buf);
+                 (void) get_compression_header (&chdr, buf, sizeof (buf));
 
                  if (chdr.ch_type == ELFCOMPRESS_ZLIB)
                    printf ("       ZLIB, ");
@@ -11584,6 +11613,9 @@ process_syminfo (FILE * file ATTRIBUTE_UNUSED)
   return 1;
 }
 
+#define IN_RANGE(START,END,ADDR,OFF)           \
+  (((ADDR) >= (START)) && ((ADDR) + (OFF) < (END)))
+
 /* Check to see if the given reloc needs to be handled in a target specific
    manner.  If so then process the reloc and return TRUE otherwise return
    FALSE.
@@ -11666,12 +11698,12 @@ target_specific_reloc_handling (Elf_Internal_Rela * reloc,
                    value = reloc->r_addend + (symtab[sym_index].st_value
                                               - saved_sym->st_value);
 
-                   if (start + reloc->r_offset + reloc_size >= end)
-                     /* PR 21137 */
-                     error (_("MSP430 sym diff reloc writes past end of section (%p vs %p)\n"),
-                            start + reloc->r_offset + reloc_size, end);
-                   else
+                   if (IN_RANGE (start, end, start + reloc->r_offset, reloc_size))
                      byte_put (start + reloc->r_offset, value, reloc_size);
+                   else
+                     /* PR 21137 */
+                     error (_("MSP430 sym diff reloc contains invalid offset: 0x%lx\n"),
+                            (long) reloc->r_offset);
                  }
 
                saved_sym = NULL;
@@ -11725,11 +11757,11 @@ target_specific_reloc_handling (Elf_Internal_Rela * reloc,
                    value = reloc->r_addend + (symtab[sym_index].st_value
                                               - saved_sym->st_value);
 
-                   if (start + reloc->r_offset + reloc_size >= end)
-                     error (_("MN10300 sym diff reloc writes past end of section (%p vs %p)\n"),
-                            start + reloc->r_offset + reloc_size, end);
-                   else
+                   if (IN_RANGE (start, end, start + reloc->r_offset, reloc_size))
                      byte_put (start + reloc->r_offset, value, reloc_size);
+                   else
+                     error (_("MN10300 sym diff reloc contains invalid offset: 0x%lx\n"),
+                            (long) reloc->r_offset);
                  }
 
                saved_sym = NULL;
@@ -11777,20 +11809,20 @@ target_specific_reloc_handling (Elf_Internal_Rela * reloc,
            break;
 
          case 0x41: /* R_RL78_ABS32.  */
-           if (start + reloc->r_offset + 4 >= end)
-             error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
-                    start + reloc->r_offset + 2, end);
-           else
+           if (IN_RANGE (start, end, start + reloc->r_offset, 4))
              byte_put (start + reloc->r_offset, value, 4);
+           else
+             error (_("RL78 sym diff reloc contains invalid offset: 0x%lx\n"),
+                    (long) reloc->r_offset);
            value = 0;
            return TRUE;
 
          case 0x43: /* R_RL78_ABS16.  */
-           if (start + reloc->r_offset + 2 >= end)
-             error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
-                    start + reloc->r_offset + 2, end);
-           else
+           if (IN_RANGE (start, end, start + reloc->r_offset, 2))
              byte_put (start + reloc->r_offset, value, 2);
+           else
+             error (_("RL78 sym diff reloc contains invalid offset: 0x%lx\n"),
+                    (long) reloc->r_offset);
            value = 0;
            return TRUE;
 
@@ -12643,7 +12675,8 @@ dump_section_as_strings (Elf_Internal_Shdr * section, FILE * file)
        {
          Elf_Internal_Chdr chdr;
          unsigned int compression_header_size
-           = get_compression_header (& chdr, (unsigned char *) start);
+           = get_compression_header (& chdr, (unsigned char *) start,
+                                     num_bytes);
 
          if (chdr.ch_type != ELFCOMPRESS_ZLIB)
            {
@@ -12678,10 +12711,20 @@ dump_section_as_strings (Elf_Internal_Shdr * section, FILE * file)
          new_size -= 12;
        }
 
-      if (uncompressed_size
-         && uncompress_section_contents (& start,
-                                         uncompressed_size, & new_size))
-       num_bytes = new_size;
+      if (uncompressed_size)
+       {
+         if (uncompress_section_contents (& start,
+                                          uncompressed_size, & new_size))
+           num_bytes = new_size;
+         else
+           {
+             error (_("Unable to decompress section %s\n"),
+                    printable_section_name (section));
+             return;
+           }
+       }
+      else
+       start = real_start;
     }
 
   /* If the section being dumped has relocations against it the user might
@@ -12777,7 +12820,7 @@ dump_section_as_bytes (Elf_Internal_Shdr * section,
        {
          Elf_Internal_Chdr chdr;
          unsigned int compression_header_size
-           = get_compression_header (& chdr, start);
+           = get_compression_header (& chdr, start, section_size);
 
          if (chdr.ch_type != ELFCOMPRESS_ZLIB)
            {
@@ -12812,10 +12855,23 @@ dump_section_as_bytes (Elf_Internal_Shdr * section,
          new_size -= 12;
        }
 
-      if (uncompressed_size
-         && uncompress_section_contents (& start, uncompressed_size,
-                                         & new_size))
-       section_size = new_size;
+      if (uncompressed_size)
+       {
+         if (uncompress_section_contents (& start, uncompressed_size,
+                                          & new_size))
+           {
+             section_size = new_size;
+           }
+         else
+           {
+             error (_("Unable to decompress section %s\n"),
+                    printable_section_name (section));
+             /* FIXME: Print the section anyway ?  */
+             return;
+           }
+       }
+      else
+       start = real_start;
     }
 
   if (relocate)
@@ -12930,7 +12986,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
              return 0;
            }
 
-         compression_header_size = get_compression_header (&chdr, start);
+         compression_header_size = get_compression_header (&chdr, start, size);
 
          if (chdr.ch_type != ELFCOMPRESS_ZLIB)
            {
@@ -12965,15 +13021,24 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
          size -= 12;
        }
 
-      if (uncompressed_size
-         && uncompress_section_contents (&start, uncompressed_size,
-                                         &size))
+      if (uncompressed_size)
        {
-         /* Free the compressed buffer, update the section buffer
-            and the section size if uncompress is successful.  */
-         free (section->start);
-         section->start = start;
+         if (uncompress_section_contents (&start, uncompressed_size,
+                                          &size))
+           {
+             /* Free the compressed buffer, update the section buffer
+                and the section size if uncompress is successful.  */
+             free (section->start);
+             section->start = start;
+           }
+         else
+           {
+             error (_("Unable to decompress section %s\n"),
+                    printable_section_name (sec));
+             return 0;
+           }
        }
+
       section->size = size;
     }