From db0c309f4011ca94a4abc8458e27f3734dab92ac Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Tue, 24 Apr 2018 16:57:04 +0100 Subject: [PATCH] Fix an illegal memory access when trying to copy an ELF binary with corrupt section symbols. PR 23113 * elf.c (ignore_section_sym): Check for the output_section pointer being NULL before dereferencing it. --- bfd/ChangeLog | 4 ++++ bfd/elf.c | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 32cd8933c2c..edd822fefa4 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,5 +1,9 @@ 2018-04-24 Nick Clifton + PR 23113 + * elf.c (ignore_section_sym): Check for the output_section pointer + being NULL before dereferencing it. + PR 23110 * peXXigen.c (_bfd_XX_bfd_copy_private_bfd_data_common): Check for a negative PE_DEBUG_DATA size before iterating over the debug data. diff --git a/bfd/elf.c b/bfd/elf.c index 8ea5a81cbe3..092b275ae20 100644 --- a/bfd/elf.c +++ b/bfd/elf.c @@ -4022,15 +4022,22 @@ ignore_section_sym (bfd *abfd, asymbol *sym) { elf_symbol_type *type_ptr; + if (sym == NULL) + return FALSE; + if ((sym->flags & BSF_SECTION_SYM) == 0) return FALSE; + if (sym->section == NULL) + return TRUE; + type_ptr = elf_symbol_from (abfd, sym); return ((type_ptr != NULL && type_ptr->internal_elf_sym.st_shndx != 0 && bfd_is_abs_section (sym->section)) || !(sym->section->owner == abfd - || (sym->section->output_section->owner == abfd + || (sym->section->output_section != NULL + && sym->section->output_section->owner == abfd && sym->section->output_offset == 0) || bfd_is_abs_section (sym->section))); } -- 2.30.2