From 472dd8b357e878b09ffa0703ad80b2915aaa4ec6 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Fri, 30 Jul 2021 12:56:22 +0930 Subject: [PATCH] Sanity check _bfd_coff_read_string_table * coffgen.c (_bfd_coff_read_string_table): Catch overflows when calculating string table file location. --- bfd/coffgen.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/bfd/coffgen.c b/bfd/coffgen.c index 017d4c31a4e..ca936828468 100644 --- a/bfd/coffgen.c +++ b/bfd/coffgen.c @@ -1662,8 +1662,10 @@ _bfd_coff_read_string_table (bfd *abfd) char extstrsize[STRING_SIZE_SIZE]; bfd_size_type strsize; char *strings; - file_ptr pos; + ufile_ptr pos; ufile_ptr filesize; + size_t symesz; + size_t size; if (obj_coff_strings (abfd) != NULL) return obj_coff_strings (abfd); @@ -1674,9 +1676,16 @@ _bfd_coff_read_string_table (bfd *abfd) return NULL; } + symesz = bfd_coff_symesz (abfd); pos = obj_sym_filepos (abfd); - pos += obj_raw_syment_count (abfd) * bfd_coff_symesz (abfd); - if (bfd_seek (abfd, pos, SEEK_SET) != 0) + if (_bfd_mul_overflow (obj_raw_syment_count (abfd), symesz, &size) + || pos + size < pos) + { + bfd_set_error (bfd_error_file_truncated); + return NULL; + } + + if (bfd_seek (abfd, pos + size, SEEK_SET) != 0) return NULL; if (bfd_bread (extstrsize, (bfd_size_type) sizeof extstrsize, abfd) -- 2.30.2