From: H.J. Lu <hjl.tools@gmail.com>
Date: Mon, 26 Jun 2017 16:24:49 +0000 (-0700)
Subject: Check file size before getting section contents
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=0630b49c470ca2e3c3f74da4c7e4ff63440dd71f;p=binutils-gdb.git

Check file size before getting section contents

Don't check the section size in bfd_get_full_section_contents since
the size of a decompressed section may be larger than the file size.
Instead, check file size in _bfd_generic_get_section_contents.

	PR binutils/21665
	* compress.c (bfd_get_full_section_contents): Don't check the
	file size here.
	* libbfd.c (_bfd_generic_get_section_contents): Check for and
	reject a section whoes size + offset is greater than the size
	of the entire file.
	(_bfd_generic_get_section_contents_in_window): Likewise.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index ee926c6fdfc..e088cdcad26 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,4 +1,12 @@
-2017-06-26  Maciej W. Rozycki  <macro@imgtec.com>
+2017-06-26  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR binutils/21665
+	* compress.c (bfd_get_full_section_contents): Don't check the
+	file size here.
+	* libbfd.c (_bfd_generic_get_section_contents): Check for and
+	reject a section whoes size + offset is greater than the size
+	of the entire file.
+	(_bfd_generic_get_section_contents_in_window): Likewise.
 
 2017-06-26  Nick Clifton  <nickc@redhat.com>
 
diff --git a/bfd/compress.c b/bfd/compress.c
index 7b2c37c4187..ef549f9db02 100644
--- a/bfd/compress.c
+++ b/bfd/compress.c
@@ -239,12 +239,6 @@ bfd_get_full_section_contents (bfd *abfd, sec_ptr sec, bfd_byte **ptr)
       *ptr = NULL;
       return TRUE;
     }
-  else if (bfd_get_file_size (abfd) > 0
-	   && sz > (bfd_size_type) bfd_get_file_size (abfd))
-    {
-      *ptr = NULL;
-      return FALSE;
-    }
 
   switch (sec->compress_status)
     {
@@ -260,7 +254,7 @@ bfd_get_full_section_contents (bfd *abfd, sec_ptr sec, bfd_byte **ptr)
 		  /* xgettext:c-format */
 		  (_("error: %B(%A) is too large (%#lx bytes)"),
 		  abfd, sec, (long) sz);
-	    return FALSE;
+	      return FALSE;
 	    }
 	}
 
diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index 554234fbcfd..b903328cede 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -789,6 +789,7 @@ _bfd_generic_get_section_contents (bfd *abfd,
 				   bfd_size_type count)
 {
   bfd_size_type sz;
+  file_ptr filesz;
   if (count == 0)
     return TRUE;
 
@@ -811,8 +812,15 @@ _bfd_generic_get_section_contents (bfd *abfd,
     sz = section->rawsize;
   else
     sz = section->size;
+  filesz = bfd_get_file_size (abfd);
+  if (filesz < 0)
+    {
+      /* This should never happen.  */
+      abort ();
+    }
   if (offset + count < count
-      || offset + count > sz)
+      || offset + count > sz
+      || (section->filepos + offset + sz) > (bfd_size_type) filesz)
     {
       bfd_set_error (bfd_error_invalid_operation);
       return FALSE;
@@ -835,6 +843,7 @@ _bfd_generic_get_section_contents_in_window
 {
 #ifdef USE_MMAP
   bfd_size_type sz;
+  file_ptr filesz;
 
   if (count == 0)
     return TRUE;
@@ -867,7 +876,13 @@ _bfd_generic_get_section_contents_in_window
     sz = section->rawsize;
   else
     sz = section->size;
+  filesz = bfd_get_file_size (abfd);
+    {
+      /* This should never happen.  */
+      abort ();
+    }
   if (offset + count > sz
+      || (section->filepos + offset + sz) > (bfd_size_type) filesz
       || ! bfd_get_file_window (abfd, section->filepos + offset, count, w,
 				TRUE))
     return FALSE;