[Bug binutils/15157] readelf crash (double free?)

[paul.marinescu at imperial dot ac.uk]

http://sourceware.org/bugzilla/show_bug.cgi?id=15157

--- Comment #1 from Paul Marinescu <paul.marinescu at imperial dot ac.uk> 
2013-02-19 16:12:26 UTC ---
I looked a bit more into this and it seems that the problem has to do with
handling of relocation offsets. More exactly, in readelf.c:10512, the code
checks for a invalid (too big) relocation offset:

rloc = start + rp->r_offset;
if ((rloc + reloc_size) > end)
{
  warn (_("skipping invalid relocation offset 0x%lx in section %s\n"),
         (unsigned long) rp->r_offset,
         SECTION_NAME (section));
  continue;
}

However, the code fails to take into account a value such as rp->r_offset =
(unsigned long)-5. One possible implication would be that a specially crafted
binary can make readelf write to any memory location below rloc.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.