[Bug binutils/17512] libbfd/binutils: crashes on fuzzed samples

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17512

--- Comment #234 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot 
gnu.org> ---
The master branch has been updated by Mark Wielaard <address@hidden>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=39e224f6f9ee3f6123d4c9ddb7c0955e0604c1b4

commit 39e224f6f9ee3f6123d4c9ddb7c0955e0604c1b4
Author: Mark Wielaard <address@hidden>
Date:   Mon Mar 20 15:32:34 2017 +0100

    readelf: Don't error on .debug files with NOBITS .dynamic section.

    The fix for PR binutils/17512 added a check for the dynamic segment being
    inside the actual ELF file. If not an error message would be produced:

    readelf: Error: the dynamic segment offset + size exceeds the size of the
file

    Unfortunately for separate debuginfo files it is common for the dynamic
    segment not being inside the file because the .dynamic section is NOBITS.

    Since the check is done unconditionally in process_program_headers and
    process_program_headers is always called (to setup dynamic_addr in case
    it is needed). The error is produced on any operations done on any .debug
    file (even if no program headers or the dynamic segment is used).

    If there are section headers then a cross check is done to see if the
    .dynamic section is NOBITS in which case dynamic_addr is set to zero
    without a warning or error (which is then checked first before any
    operation on the dynamic segement is done).

    Move the check for the dynamic segment being inside the actual ELF file
    after the cross check with the section headers to suppress the error for
    .debug files.

    binutils/ChangeLog:

        * readelf.c (process_program_headers): Move dynamic_addr check
        after .dynamic section cross check.

-- 
You are receiving this mail because:
You are on the CC list for the bug.