Date: Sun, 7 Nov 2010 20:44:46 +0000 (UTC) From: Oleksandr Tymoshenko <gonzo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r214950 - head/contrib/binutils/bfd Message-ID: <201011072044.oA7Kik8A079633@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gonzo Date: Sun Nov 7 20:44:46 2010 New Revision: 214950 URL: http://svn.freebsd.org/changeset/base/214950 Log: Prevent endless loop by detecting broken MIPS.options Modified: head/contrib/binutils/bfd/elfxx-mips.c Modified: head/contrib/binutils/bfd/elfxx-mips.c ============================================================================== --- head/contrib/binutils/bfd/elfxx-mips.c Sun Nov 7 20:40:00 2010 (r214949) +++ head/contrib/binutils/bfd/elfxx-mips.c Sun Nov 7 20:44:46 2010 (r214950) @@ -4330,6 +4330,15 @@ _bfd_mips_elf_section_processing (bfd *a bfd_mips_elf_swap_options_in (abfd, (Elf_External_Options *) l, &intopt); + if (intopt.size < sizeof (Elf_External_Options)) + { + (*_bfd_error_handler) + (_("Warning: bad `%s' option size %u smaller than its header"), + MIPS_ELF_OPTIONS_SECTION_NAME (abfd), intopt.size); + break; + } + + if (ABI_64_P (abfd) && intopt.kind == ODK_REGINFO) { bfd_byte buf[8]; @@ -4542,6 +4551,14 @@ _bfd_mips_elf_section_from_shdr (bfd *ab bfd_mips_elf_swap_options_in (abfd, (Elf_External_Options *) l, &intopt); + if (intopt.size < sizeof (Elf_External_Options)) + { + (*_bfd_error_handler) + (_("Warning: bad `%s' option size %u smaller than its header"), + MIPS_ELF_OPTIONS_SECTION_NAME (abfd), intopt.size); + break; + } + if (ABI_64_P (abfd) && intopt.kind == ODK_REGINFO) { Elf64_Internal_RegInfo intreg;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201011072044.oA7Kik8A079633>