From 3de58d950c984bce176d883a8e7bcf3415be8c84 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Wed, 21 Jun 2017 12:04:07 +0100 Subject: [PATCH] Fix potential address violation parsing a corrupt Alpha VMS file. PR binutils/21638 * vms-alpha.c (_bfd_vms_slurp_egsd): Check for an undersized record. --- bfd/ChangeLog | 6 ++++++ bfd/vms-alpha.c | 10 ++++++++++ 2 files changed, 16 insertions(+) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 8edcbc2..c92ed67 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,5 +1,11 @@ 2017-06-21 Nick Clifton + PR binutils/21638 + * vms-alpha.c (_bfd_vms_slurp_egsd): Check for an undersized + record. + +2017-06-21 Nick Clifton + PR binutils/21637 * vms-alpha.c (_bfd_vms_slurp_egsd): Check for an empty section list. diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c index aa38de9..5f1b24a 100644 --- a/bfd/vms-alpha.c +++ b/bfd/vms-alpha.c @@ -1143,6 +1143,14 @@ _bfd_vms_slurp_egsd (bfd *abfd) vms_debug2 ((2, "EGSD\n")); + if (PRIV (recrd.rec_size) < 8) + { + _bfd_error_handler (_("Corrupt EGSD record: its size (%#x) is too small"), + PRIV (recrd.rec_size)); + bfd_set_error (bfd_error_bad_value); + return FALSE; + } + PRIV (recrd.rec) += 8; /* Skip type, size, align pad. */ PRIV (recrd.rec_size) -= 8; @@ -1354,6 +1362,8 @@ _bfd_vms_slurp_egsd (bfd *abfd) PRIV (recrd.rec) += gsd_size; } + /* FIXME: Should we complain if PRIV (recrd.rec_size) is not zero ? */ + if (PRIV (gsd_sym_count) > 0) abfd->flags |= HAS_SYMS; -- 2.7.4