https://sourceware.org/bugzilla/show_bug.cgi?id=34883
Bug ID: 34883
Summary: xcofflink: out-of-bounds heap read on malformed
function line number offset
Product: binutils
Version: 2.48 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: harshit7kr at gmail dot com
Target Milestone: ---
In bfd/xcofflink.c, xcoff_link_add_symbols (Pass 1) and xcoff_link_input_bfd
(Pass 2) compute the line-number offset `linoff` for a function symbol as:
linoff = auxlin.x_sym.x_fcnary.x_fcn.x_lnnoptr - enclosing->line_filepos;
A corrupt or crafted XCOFF object can supply an x_lnnoptr that results in:
1. A negative `linoff`: Pass 1 checked `if (linoff < (bfd_signed_vma)
(enclosing->lineno_count * linesz))`. A negative linoff passed this check,
leading to reading before the start of the allocated line-number buffer
(`reloc_info[enclosing->target_index].linenos + linoff`) at xcofflink.c:1558
(heap-buffer-overflow underflow read).
2. A misaligned `linoff` (not a multiple of record size `linesz`): Pass 1
scanned records sequentially (`linp += linesz`) starting from a misaligned
offset, reading past the end of the line-number table buffer at
xcofflink.c:1573.
3. An inflated `linoff` (pointing past table end): Silently accepted without
error diagnostic in Pass 1, dropping line numbers.
4. Pass 2 lacked bounds validation when indexing `flinfo->linenos + linoff`.
Proposed fix:
- Pass 1: Validate that `linoff >= 0`, `linoff % linesz == 0`, and `linoff +
linesz <= enclosing->lineno_count * linesz`. Report an error ("%pB: `%s' has
invalid line number offset") and set bfd_error_bad_value on malformed inputs.
- Pass 2: Add defensive bounds validation against enclosing table size `amt`.
- Allocate flinfo.linenos using bfd_zmalloc to avoid disclosing uninitialized
heap bytes.
- Add regression test coverage in ld-powerpc/xcoff-aux.exp covering positive
control, negative offset, inflated offset, and misaligned offset.
A patch with regression tests has been prepared and will be submitted to
[email protected].
--
You are receiving this mail because:
You are on the CC list for the bug.
