[Bug binutils/21665] Multiple heap based buffer overflow in the objdump tool of the GNU Binutils.

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21665

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
   Last reconfirmed|                            |2017-06-26
                 CC|                            |hjl.tools at gmail dot com
         Resolution|FIXED                       |---
     Ever confirmed|0                           |1

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to address@hidden from comment #1)
> The master branch has been updated by Nick Clifton <address@hidden>:
> 
> https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;
> h=cfd14a500e0485374596234de4db10e88ebc7618
> 
> commit cfd14a500e0485374596234de4db10e88ebc7618
> Author: Nick Clifton <address@hidden>
> Date:   Mon Jun 26 15:25:08 2017 +0100
> 
>     Fix address violations when atempting to parse fuzzed binaries.
>     
>       PR binutils/21665
>     bfd       * opncls.c (get_build_id): Check that the section is beig enough
>       to contain the whole note.
>       * compress.c (bfd_get_full_section_contents): Check for and reject
>       a section whoes size is greater than the size of the entire file.
>       * elf32-v850.c (v850_elf_copy_notes): Allow for the ouput to not
>       contain a notes section.
>     
>     binutils* objdump.c (disassemble_section): Skip any section that is
> bigger
>       than the entire file.

This patch caused:

FAIL: Build libfoo.so with compressed debug sections
FAIL: Build libbar.so with compressed debug sections
FAIL: Build libfoozlib.so with compressed debug sections with zlib-gabi
FAIL: Build libbarzlib.so with compressed debug sections with zlib-gabi
FAIL: Build libzlibfoo.so with zlib compressed debug sections
FAIL: Build libgnufoo.so with zlib-gnu compressed debug sections
FAIL: Build libgabifoo.so with zlib-gabi compressed debug sections
FAIL: Build gabiend.o with zlib-gabi compressed debug sections
FAIL: Run normal with libfoo.so with compressed debug sections
FAIL: Run normal with libfoozlib.so with compressed debug sections with
zlib-gabi
FAIL: Run zlibnormal with libzlibfoo.so with zlib compressed debug sections
FAIL: Run zlibnormal with libfoozlib.so with zlib compressed debug sections
FAIL: Run gnunormal with libgnufoo.so with zlib-gnu compressed debug sections
FAIL: Run gnunormal with libfoozlib.so with zlib-gnu compressed debug sections
FAIL: Run gabinormal with libgabifoo.so with zlib-gabi compressed debug
sections
FAIL: Run gabinormal with libfoozlib.so with zlib-gabi compressed debug
sections
FAIL: Link with zlib-gabi compressed debug input
FAIL: Link -r with zlib-gabi compressed debug output
FAIL: Link with zlib compressed debug output
FAIL: Link with zlib-gnu compressed debug output
FAIL: Link with zlib-gabi compressed debug output

with GCC 4.2 on x86-64.

-- 
You are receiving this mail because:
You are on the CC list for the bug.