From ef4e5ba50c76511d4306edf1526c15269f1d7747 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Tue, 14 Jan 2020 10:45:41 +1030 Subject: som: Don't loop forever reading symbol chains * som.c (som_bfd_count_ar_symbols): Error when file position of symbols on chains is not strictly increasing. --- bfd/ChangeLog | 5 +++++ bfd/som.c | 13 +++++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index acb545cd03c..75099e91b22 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,8 @@ +2020-01-14 Alan Modra + + * som.c (som_bfd_count_ar_symbols): Error when file position + of symbols on chains is not strictly increasing. + 2020-01-14 Alan Modra * vms.h (VMS_DEBUG): Define as 0. diff --git a/bfd/som.c b/bfd/som.c index 779fd5d3883..8e8960ed83f 100644 --- a/bfd/som.c +++ b/bfd/som.c @@ -5892,8 +5892,8 @@ som_bfd_count_ar_symbols (bfd *abfd, /* Don't forget to initialize the counter! */ *count = 0; - /* Read in the hash table. The has table is an array of 32bit file offsets - which point to the hash chains. */ + /* Read in the hash table. The hash table is an array of 32-bit + file offsets which point to the hash chains. */ amt = (bfd_size_type) lst_header->hash_size * 4; if (bfd_bread ((void *) hash_table, amt, abfd) != amt) goto error_return; @@ -5928,6 +5928,15 @@ som_bfd_count_ar_symbols (bfd *abfd, if (next_entry == 0) break; + /* Assume symbols on a chain are in increasing file offset + order. Otherwise we can loop here with fuzzed input. */ + if (next_entry < hash_val + sizeof (ext_lst_symbol)) + { + bfd_set_error (bfd_error_bad_value); + goto error_return; + } + hash_val = next_entry; + /* Seek to the next symbol. */ if (bfd_seek (abfd, lst_filepos + next_entry, SEEK_SET) != 0) goto error_return; -- cgit v1.2.1