diff options
| author | gonzo <gonzo@FreeBSD.org> | 2010-11-07 20:44:46 +0000 |
|---|---|---|
| committer | gonzo <gonzo@FreeBSD.org> | 2010-11-07 20:44:46 +0000 |
| commit | 2edfde994904860eb628d23f4ffd0ee0ede92110 (patch) | |
| tree | afa3d0e86a87446d55b8d5ca2fee4261a18cc4dc /contrib/binutils | |
| parent | ce9c2777c86603e7f95cb82f708bffd0495eb5bf (diff) | |
| download | FreeBSD-src-2edfde994904860eb628d23f4ffd0ee0ede92110.zip FreeBSD-src-2edfde994904860eb628d23f4ffd0ee0ede92110.tar.gz | |
Prevent endless loop by detecting broken MIPS.options
Diffstat (limited to 'contrib/binutils')
| -rw-r--r-- | contrib/binutils/bfd/elfxx-mips.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/contrib/binutils/bfd/elfxx-mips.c b/contrib/binutils/bfd/elfxx-mips.c index 0a7495a..87973d5 100644 --- a/contrib/binutils/bfd/elfxx-mips.c +++ b/contrib/binutils/bfd/elfxx-mips.c @@ -4330,6 +4330,15 @@ _bfd_mips_elf_section_processing (bfd *abfd, Elf_Internal_Shdr *hdr) bfd_mips_elf_swap_options_in (abfd, (Elf_External_Options *) l, &intopt); + if (intopt.size < sizeof (Elf_External_Options)) + { + (*_bfd_error_handler) + (_("Warning: bad `%s' option size %u smaller than its header"), + MIPS_ELF_OPTIONS_SECTION_NAME (abfd), intopt.size); + break; + } + + if (ABI_64_P (abfd) && intopt.kind == ODK_REGINFO) { bfd_byte buf[8]; @@ -4542,6 +4551,14 @@ _bfd_mips_elf_section_from_shdr (bfd *abfd, Elf_Internal_Shdr *hdr, bfd_mips_elf_swap_options_in (abfd, (Elf_External_Options *) l, &intopt); + if (intopt.size < sizeof (Elf_External_Options)) + { + (*_bfd_error_handler) + (_("Warning: bad `%s' option size %u smaller than its header"), + MIPS_ELF_OPTIONS_SECTION_NAME (abfd), intopt.size); + break; + } + if (ABI_64_P (abfd) && intopt.kind == ODK_REGINFO) { Elf64_Internal_RegInfo intreg; |
