From: Nick Clifton <nickc@redhat.com>
Date: Fri, 30 Apr 2021 13:19:24 +0000 (+0100)
Subject: Fix an illegal memory access when parsing a corrupt core note.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=9f84cb380e8403ad4f1184fd09af475c17fd8835;p=binutils-gdb.git

Fix an illegal memory access when parsing a corrupt core note.

	PR 27799
	* elf32-xtensa.c (elf_xtensa_grok_prstatus): Check for core notes
	that are too small.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 548ed9f57d3..cd9b1b38607 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2021-04-30  Nick Clifton  <nickc@redhat.com>
+
+	PR 27799
+	* elf32-xtensa.c (elf_xtensa_grok_prstatus): Check for core notes
+	that are too small.
+
 2021-04-30  Nick Clifton  <nickc@redhat.com>
 
 	PR 27797
diff --git a/bfd/elf32-xtensa.c b/bfd/elf32-xtensa.c
index c1781c7a7d7..7c5fb558bfb 100644
--- a/bfd/elf32-xtensa.c
+++ b/bfd/elf32-xtensa.c
@@ -3740,8 +3740,14 @@ elf_xtensa_grok_prstatus (bfd *abfd, Elf_Internal_Note *note)
   int offset;
   unsigned int size;
 
+  if (elf_tdata (abfd) == NULL
+      || elf_tdata (abfd)->core == NULL)
+    return false;
+
   /* The size for Xtensa is variable, so don't try to recognize the format
      based on the size.  Just assume this is GNU/Linux.  */
+  if (note == NULL || note->descsz < 28)
+    return false;
 
   /* pr_cursig */
   elf_tdata (abfd)->core->signal = bfd_get_16 (abfd, note->descdata + 12);
@@ -3758,7 +3764,6 @@ elf_xtensa_grok_prstatus (bfd *abfd, Elf_Internal_Note *note)
 					  size, note->descpos + offset);
 }
 
-
 static bool
 elf_xtensa_grok_psinfo (bfd *abfd, Elf_Internal_Note *note)
 {