From: Nick Clifton <nickc@redhat.com>
Date: Mon, 27 Oct 2014 14:45:06 +0000 (+0000)
Subject: Fix a seg-fault in strings and other binutuils when parsing a corrupt PE
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=7e1e19887abd24aeb15066b141cdff5541e0ec8e;p=binutils-gdb.git

Fix a seg-fault in strings and other binutuils when parsing a corrupt PE
executable with an invalid value in the NumberOfRvaAndSizes field of the
AOUT header.

	PR binutils/17512
	* peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries
	with an invalid value for NumberOfRvaAndSizes.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 7ba4431112b..e1d9379bef8 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,9 @@
 2014-10-27  Nick Clifton  <nickc@redhat.com>
 
+	PR binutils/17512
+	* peXXigen.c (_bfd_XXi_swap_aouthdr_in): Handle corrupt binaries
+	with an invalid value for NumberOfRvaAndSizes.
+
 	PR binutils/17510
 	* elf.c (setup_group): Improve handling of corrupt group
 	sections.
diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index 2fb631c5a76..987be407737 100644
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -504,6 +504,18 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd,
   {
     int idx;
 
+    /* PR 17512: Corrupt PE binaries can cause seg-faults.  */
+    if (a->NumberOfRvaAndSizes > 16)
+      {
+	(*_bfd_error_handler)
+	  (_("%B: aout header specifies an invalid number of data-directory entries: %d"),
+	   abfd, a->NumberOfRvaAndSizes);
+	/* Paranoia: If the number is corrupt, then assume that the
+	   actual entries themselves might be corrupt as well.  */
+	a->NumberOfRvaAndSizes = 0;
+      }
+
+
     for (idx = 0; idx < a->NumberOfRvaAndSizes; idx++)
       {
         /* If data directory is empty, rva also should be 0.  */