From: Nick Clifton Date: Fri, 30 Apr 2021 11:11:35 +0000 (+0100) Subject: Fix illegal memory access when parsing a corrupt PE format file. X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=bceb87ef4da7948eb9f39584fb5b4a62f9ed4846;p=binutils-gdb.git Fix illegal memory access when parsing a corrupt PE format file. PR 27795 * coff-rs6000.c (_bfd_xcoff_read_ar_hdr): Check for invalid name lengths. --- diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 4bdee1cb123..cd904dac586 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,9 @@ +2021-04-30 Nick Clifton + + PR 27795 + * coff-rs6000.c (_bfd_xcoff_read_ar_hdr): Check for invalid name + lengths. + 2021-04-29 Nick Clifton PR 27793 diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c index 491efbae80c..0745421cf11 100644 --- a/bfd/coff-rs6000.c +++ b/bfd/coff-rs6000.c @@ -1619,6 +1619,8 @@ _bfd_xcoff_read_ar_hdr (bfd *abfd) return NULL; GET_VALUE_IN_FIELD (namlen, hdr.namlen, 10); + if (namlen > bfd_get_file_size (abfd)) + return NULL; amt = sizeof (struct areltdata) + SIZEOF_AR_HDR + namlen + 1; ret = (struct areltdata *) bfd_malloc (amt); if (ret == NULL) @@ -1646,6 +1648,8 @@ _bfd_xcoff_read_ar_hdr (bfd *abfd) return NULL; GET_VALUE_IN_FIELD (namlen, hdr.namlen, 10); + if (namlen > bfd_get_file_size (abfd)) + return NULL; amt = sizeof (struct areltdata) + SIZEOF_AR_HDR_BIG + namlen + 1; ret = (struct areltdata *) bfd_malloc (amt); if (ret == NULL)