[Bug binutils/17512] segfault in PE parser / _bfd_pei_swap_aouthdr_in

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17512

--- Comment #50 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot 
gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "gdb and binutils".

The branch, master has been updated
       via  5a3f568b70bdfb91aacdfb66657b56d8c6d242f1 (commit)
      from  ba241f2d5a6f1ac57e746d230892e27a70def4a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5a3f568b70bdfb91aacdfb66657b56d8c6d242f1

commit 5a3f568b70bdfb91aacdfb66657b56d8c6d242f1
Author: Nick Clifton <address@hidden>
Date:   Mon Nov 3 17:44:00 2014 +0000

    More fixes for buffer overruns instigated by corrupt binaries.

        PR binutils/17512
        * objdump.c (slurp_symtab): Fail gracefully if the table could not
        be read.
        (dump_relocs_in_section): Likewise.

        * aoutx.h (slurp_symbol_table): Check that computed table size is
        not bigger than the file from which is it being read.
        (slurp_reloc_table): Likewise.
        * coffcode.h (coff_slurp_line_table): Remove unneeded local
        'warned'.  Do not try to print the details of a symbol with an
        invalid index.
        * coffgen.c (make_a_sectiobn_from_file): Check computed string
        index against length of string table.
        (bfd_coff_internal_syment_name): Check read in string offset
        against length of string table.
        (build_debug_section): Return a pointer to the section used.
        (_bfd_coff_read_string_table): Store the length of the string
        table in the coff_tdata structure.
        (bfd_coff_free_symbols): Set the length of the string table to
        zero when it is freed.
        (coff_get_normalized_symtab): Check offsets against string table
        or data table lengths as appropriate.
        * cofflink.c (_bfd_coff_link_input_bfd): Check offset against
        length of string table.
        * compress.c (bfd_get_full_section_contents): Check computed size
        against the size of the file.
        * libcoff-in.h (obj_coff_strings_len): Define.
        (struct coff_tdata): Add strings_len field.
        * libcoff.h: Regenerate.
        * peXXigen.c (pe_print_debugdata): Do not attempt to print the
        data if the debug section is too small.
        * xcofflink.c (xcoff_link_input_bfd):  Check offset against
        length of string table.

-----------------------------------------------------------------------

Summary of changes:
 bfd/ChangeLog      |   32 +++++++++++++++++++++++
 bfd/aoutx.h        |    7 +++++
 bfd/coffcode.h     |   11 +++-----
 bfd/coffgen.c      |   72 +++++++++++++++++++++++++++++++++++++--------------
 bfd/cofflink.c     |    5 +++-
 bfd/compress.c     |    7 +++++
 bfd/libcoff-in.h   |    3 ++
 bfd/libcoff.h      |    3 ++
 bfd/peXXigen.c     |    9 ++++++-
 bfd/xcofflink.c    |    5 +++-
 binutils/ChangeLog |    7 +++++
 binutils/objdump.c |   11 ++++++-
 12 files changed, 140 insertions(+), 32 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.