binutils/backport-CVE-2022-48064.patch
liningjie 6bb9aa22e1 fix CVE-2022-48064
(cherry picked from commit 47e4c73208a666176ea0902b85c668413e0e8211)
2023-08-31 15:19:00 +08:00

56 lines
1.8 KiB
Diff

From c732ae93a2592431f94b3d92759028551088c40e Mon Sep 17 00:00:00 2001
From: liningjie <liningjie@xfusion.com>
Date: Thu, 31 Aug 2023 11:36:07 +0800
Subject: [PATCH] PR29922, SHT_NOBITS section avoids section size sanity check
PR 29922
* dwarf2.c (find_debug_info): Ignore sections without
SEC_HAS_CONTENTS.
---
bfd/dwarf2.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
index dd3568a8..807e9539 100644
--- a/bfd/dwarf2.c
+++ b/bfd/dwarf2.c
@@ -3913,19 +3913,22 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections,
{
look = debug_sections[debug_info].uncompressed_name;
msec = bfd_get_section_by_name (abfd, look);
- if (msec != NULL)
+ /* Testing SEC_HAS_CONTENTS is an anti-fuzzer measure. Of
+ course debug sections always have contents. */
+ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0)
return msec;
look = debug_sections[debug_info].compressed_name;
if (look != NULL)
{
msec = bfd_get_section_by_name (abfd, look);
- if (msec != NULL)
+ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0)
return msec;
}
for (msec = abfd->sections; msec != NULL; msec = msec->next)
- if (CONST_STRNEQ (msec->name, GNU_LINKONCE_INFO))
+ if ((msec->flags & SEC_HAS_CONTENTS) != 0
+ && CONST_STRNEQ (msec->name, GNU_LINKONCE_INFO))
return msec;
return NULL;
@@ -3933,6 +3936,9 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections,
for (msec = after_sec->next; msec != NULL; msec = msec->next)
{
+ if ((msec->flags & SEC_HAS_CONTENTS) == 0)
+ continue;
+
look = debug_sections[debug_info].uncompressed_name;
if (strcmp (msec->name, look) == 0)
return msec;
--
2.42.0.windows.2