svn commit: r326379 - stable/11/contrib/binutils/bfd

[Ed Maste]

Author: emaste
Date: Thu Nov 30 00:24:28 2017
New Revision: 326379
URL: https://svnweb.freebsd.org/changeset/base/326379

Log:
  MFC r326136: bfd: avoid crash on corrupt binaries
  
  From binutils commits 5a4b0ccc20ba30caef53b01bee2c0aaa5b855339 and
  7e1e19887abd24aeb15066b141cdff5541e0ec8e, made available under GPLv2
  by Nick Clifton.
  
  PR:		198824
  Security:	CVE-2014-8501
  Security:	CVE-2014-8502

Modified:
  stable/11/contrib/binutils/bfd/peXXigen.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/contrib/binutils/bfd/peXXigen.c
==============================================================================
--- stable/11/contrib/binutils/bfd/peXXigen.c	Wed Nov 29 23:52:31 2017	(r326378)
+++ stable/11/contrib/binutils/bfd/peXXigen.c	Thu Nov 30 00:24:28 2017	(r326379)
@@ -448,6 +448,17 @@ _bfd_XXi_swap_aouthdr_in (bfd * abfd,
   {
     int idx;
 
+    /* PR 17512: Corrupt PE binaries can cause seg-faults.  */
+    if (a->NumberOfRvaAndSizes > 16)
+      {
+       (*_bfd_error_handler)
+	  (_("%B: aout header specifies an invalid number of data-directory entries: %d"),
+	   abfd, a->NumberOfRvaAndSizes);
+	/* Paranoia: If the number is corrupt, then assume that the
+	   actual entries themselves might be corrupt as well.  */
+	a->NumberOfRvaAndSizes = 0;
+      }
+
     for (idx = 0; idx < 16; idx++)
       {
         /* If data directory is empty, rva also should be 0.  */
@@ -1426,6 +1437,15 @@ pe_print_edata (bfd * abfd, void * vfile)
 		   section->name);
 	  return TRUE;
 	}
+    }
+
+  /* PR 17512: Handle corrupt PE binaries.  */
+  if (datasize < 36)
+    {
+      fprintf (file,
+	       _("\nThere is an export table in %s, but it is too small (%d)\n"),
+	       section->name, (int) datasize);
+      return TRUE;
     }
 
   fprintf (file, _("\nThere is an export table in %s at 0x%lx\n"),