From patchwork Thu Nov 10 10:11:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 18043 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp56685wru; Thu, 10 Nov 2022 02:12:14 -0800 (PST) X-Google-Smtp-Source: AMsMyM5xIiu+ytf2Ue/3/+is6LHENBPiVn6ck7Z3wLTsmtF7ydS946mgI0gTz47T3/Hn+D50V71t X-Received: by 2002:a05:6402:4442:b0:461:4e7b:9808 with SMTP id o2-20020a056402444200b004614e7b9808mr2067915edb.198.1668075134548; Thu, 10 Nov 2022 02:12:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668075134; cv=none; d=google.com; s=arc-20160816; b=BXzWdSbZ1kyL9fjGqr8AHBJvenZ6o2CPsGxDwOmNh3fNPEjqKLfJ07gGL1mT2MBKWm Ze1Rudx9EhaX+rftL8yigjt93czzj3PMt0XT0KHssQO9DyxxVtLjZz9cR3bif5ns94tr m80iW7Ellm39ByBpPr1ldm5rcslIUhWSKGp/LjskFVEKprXw7PwI3b6AxyDNvW1Dlz28 OxBV9X8BbvTHGRiMF0TikeGZrDa02aQT4Nbzh7FJZwQmv9FZXtBctQRH0hNU4WTjfJqf a9Jd9wkUiN0B8GtHnROXEJy7ATTEBq991vmePM7tzvQaTdwDlqBWLVELzw9wqXbvFB/K qb7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-disposition:mime-version:message-id:subject:to:date :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=JUDrplmO8OGXDHc1IDelADnHALH6dj/5YDNZszCtcC8=; b=zcrPensm5jEV2RWLN0MQUMBFt6FUR+q/DMaJ6vAzXq0F0AUYF4/smojI9LUWeFUdpC pCn03DNXfPx0u+9QU5KTHmCRhrrnPnogX8NPezswcELXDCUHC+VZSsHAl2KP8NDATarE P5VJPPEsbI7OzIY/iS2acXtsUduQ/r1pt/g4wecga/K6YJeKZJ0oBXaw0ltV4U+KDCmK yR7TaxpfgzMQkXy4tLAHnoNsHs8SeykNpL9QVoEanluuDkqxUK+bEfeTDMWheOBkI8eL oTrkbAr0JdY+vRQS2PdD6NVbv/B/D7va9ev7HXUI/Qu5nkjKTVSfbsFhbisTjUs48n8N AOZw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=fYQYdqxc; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id bo21-20020a0564020b3500b0045d0660a039si16768132edb.316.2022.11.10.02.12.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Nov 2022 02:12:14 -0800 (PST) Received-SPF: pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=fYQYdqxc; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 466683858D3C for ; Thu, 10 Nov 2022 10:12:13 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 466683858D3C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1668075133; bh=JUDrplmO8OGXDHc1IDelADnHALH6dj/5YDNZszCtcC8=; h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=fYQYdqxclCHk8CuW4ET1NzJSL5HHuIv583YwJPy2CinlydtPGkfTHJSh0K/BmdSW5 NSZtOVrpyNFqHH8xqZJGv+N3eOP5otq8KKvPs9UmGJGR9MDrzw4+VrmjALcxM7MfXl LVn9ozUBwnglvpy/9yxI7CIf4tK5GGK1p+FFVQug= X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1030.google.com (mail-pj1-x1030.google.com [IPv6:2607:f8b0:4864:20::1030]) by sourceware.org (Postfix) with ESMTPS id F05403858D38 for ; Thu, 10 Nov 2022 10:11:59 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org F05403858D38 Received: by mail-pj1-x1030.google.com with SMTP id m14-20020a17090a3f8e00b00212dab39bcdso4326644pjc.0 for ; Thu, 10 Nov 2022 02:11:59 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=JUDrplmO8OGXDHc1IDelADnHALH6dj/5YDNZszCtcC8=; b=8QpyVZZvzK++ots/SDTEB7foVJjBY4KLsyc6GMJcnFBcHPkbCjBpLXBLHOkDs/QkYr twWAtfw3pmjCpVSG3XIPPVXTANv+MS0DlH14jKgkxEses158oy1eMot0ZMMAPSJUAikk qbJeSoriMcctkbZOe2JYrYWz6WVw2EacuJ7Tp5JaMeLKX78Gyc89b7Fg6usuv+kr0GIi LL/AUv2PHCW6RlLzSzOjtgTl7DQJjpuBmJvmBx6sBJvMaXehx4jD/BXdwD5ni9XyLgeF NeZWeq6ZzN+IlDO5VLK4fxm3MotmYdb1mMepxxIcyoWcScGHpVxntzUW1VrPqWDe3WgS sesw== X-Gm-Message-State: ACrzQf3tknT9mt12APOe7LKGHkIXUc/p5P/psuWhQDBHySvXBipwRim6 bi4rdE6GsyJ+ZM3taUufJkh5f33VyL4= X-Received: by 2002:a17:902:d386:b0:187:190f:6ac7 with SMTP id e6-20020a170902d38600b00187190f6ac7mr56778507pld.170.1668075118394; Thu, 10 Nov 2022 02:11:58 -0800 (PST) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id c11-20020a170902d48b00b00178a9b193cfsm10923470plg.140.2022.11.10.02.11.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Nov 2022 02:11:57 -0800 (PST) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 5945A11403AC; Thu, 10 Nov 2022 20:41:55 +1030 (ACDT) Date: Thu, 10 Nov 2022 20:41:55 +1030 To: binutils@sourceware.org Subject: Sanity check reloc count in get_reloc_upper_bound Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3036.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Alan Modra via Binutils From: Alan Modra Reply-To: Alan Modra Errors-To: binutils-bounces+ouuuleilei=gmail.com@sourceware.org Sender: "Binutils" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749103551976027112?= X-GMAIL-MSGID: =?utf-8?q?1749103551976027112?= The idea here is the stop tools from allocating up to 32G per section for the arelent pointer array, only to find a little later that the section reloc count was fuzzed. This usually doesn't hurt much (on systems that allow malloc overcommit) except when compiled with asan. We already do this for ELF targets, and while fixing the logic recently I decided other targets ought to do the same. * elf64-sparc.c (elf64_sparc_get_reloc_upper_bound): Sanity check section reloc count against file size. * mach-o.c (bfd_mach_o_get_reloc_upper_bound): Likewise. * aoutx.h (get_reloc_upper_bound): Likewise, and don't duplicate check done in bfd_get_reloc_upper_bound. * pdp11.c (get_reloc_upper_bound): Likewise. * coffgen.c (coff_get_reloc_upper_bound): Likewise. diff --git a/bfd/aoutx.h b/bfd/aoutx.h index 4aed23426ca..61ea9f7ce04 100644 --- a/bfd/aoutx.h +++ b/bfd/aoutx.h @@ -2485,13 +2485,7 @@ NAME (aout, canonicalize_reloc) (bfd *abfd, long NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) { - bfd_size_type count; - - if (bfd_get_format (abfd) != bfd_object) - { - bfd_set_error (bfd_error_invalid_operation); - return -1; - } + size_t count, raw; if (asect->flags & SEC_CONSTRUCTOR) count = asect->reloc_count; @@ -2507,11 +2501,21 @@ NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) return -1; } - if (count >= LONG_MAX / sizeof (arelent *)) + if (count >= LONG_MAX / sizeof (arelent *) + || _bfd_mul_overflow (count, obj_reloc_entry_size (abfd), &raw)) { bfd_set_error (bfd_error_file_too_big); return -1; } + if (!bfd_write_p (abfd)) + { + ufile_ptr filesize = bfd_get_file_size (abfd); + if (filesize != 0 && raw > filesize) + { + bfd_set_error (bfd_error_file_truncated); + return -1; + } + } return (count + 1) * sizeof (arelent *); } diff --git a/bfd/coffgen.c b/bfd/coffgen.c index 3e0fbc6184f..aab41c34ec7 100644 --- a/bfd/coffgen.c +++ b/bfd/coffgen.c @@ -1976,19 +1976,25 @@ coff_get_normalized_symtab (bfd *abfd) long coff_get_reloc_upper_bound (bfd *abfd, sec_ptr asect) { - if (bfd_get_format (abfd) != bfd_object) + size_t count, raw; + + count = asect->reloc_count; + if (count >= LONG_MAX / sizeof (arelent *) + || _bfd_mul_overflow (count, bfd_coff_relsz (abfd), &raw)) { - bfd_set_error (bfd_error_invalid_operation); + bfd_set_error (bfd_error_file_too_big); return -1; } -#if SIZEOF_LONG == SIZEOF_INT - if (asect->reloc_count >= LONG_MAX / sizeof (arelent *)) + if (!bfd_write_p (abfd)) { - bfd_set_error (bfd_error_file_too_big); - return -1; + ufile_ptr filesize = bfd_get_file_size (abfd); + if (filesize != 0 && raw > filesize) + { + bfd_set_error (bfd_error_file_truncated); + return -1; + } } -#endif - return (asect->reloc_count + 1L) * sizeof (arelent *); + return (count + 1) * sizeof (arelent *); } asymbol * diff --git a/bfd/elf64-sparc.c b/bfd/elf64-sparc.c index e9f03cf8e3a..fb4483dcd17 100644 --- a/bfd/elf64-sparc.c +++ b/bfd/elf64-sparc.c @@ -37,14 +37,25 @@ static long elf64_sparc_get_reloc_upper_bound (bfd *abfd ATTRIBUTE_UNUSED, asection *sec) { -#if SIZEOF_LONG == SIZEOF_INT - if (sec->reloc_count >= LONG_MAX / 2 / sizeof (arelent *)) + size_t count, raw; + + count = sec->reloc_count; + if (count >= LONG_MAX / 2 / sizeof (arelent *) + || _bfd_mul_overflow (count, sizeof (Elf64_External_Rela), &raw)) { bfd_set_error (bfd_error_file_too_big); return -1; } -#endif - return (sec->reloc_count * 2L + 1) * sizeof (arelent *); + if (!bfd_write_p (abfd)) + { + ufile_ptr filesize = bfd_get_file_size (abfd); + if (filesize != 0 && raw > filesize) + { + bfd_set_error (bfd_error_file_truncated); + return -1; + } + } + return (count * 2 + 1) * sizeof (arelent *); } static long diff --git a/bfd/mach-o.c b/bfd/mach-o.c index 5279343768c..664ff44a8e7 100644 --- a/bfd/mach-o.c +++ b/bfd/mach-o.c @@ -1407,17 +1407,27 @@ bfd_mach_o_write_dyld_info (bfd *abfd, bfd_mach_o_load_command *command) } long -bfd_mach_o_get_reloc_upper_bound (bfd *abfd ATTRIBUTE_UNUSED, - asection *asect) +bfd_mach_o_get_reloc_upper_bound (bfd *abfd, asection *asect) { -#if SIZEOF_LONG == SIZEOF_INT - if (asect->reloc_count >= LONG_MAX / sizeof (arelent *)) + size_t count, raw; + + count = asect->reloc_count; + if (count >= LONG_MAX / sizeof (arelent *) + || _bfd_mul_overflow (count, BFD_MACH_O_RELENT_SIZE, &raw)) { bfd_set_error (bfd_error_file_too_big); return -1; } -#endif - return (asect->reloc_count + 1L) * sizeof (arelent *); + if (!bfd_write_p (abfd)) + { + ufile_ptr filesize = bfd_get_file_size (abfd); + if (filesize != 0 && raw > filesize) + { + bfd_set_error (bfd_error_file_truncated); + return -1; + } + } + return (count + 1) * sizeof (arelent *); } /* In addition to the need to byte-swap the symbol number, the bit positions diff --git a/bfd/pdp11.c b/bfd/pdp11.c index 9ef63cc311c..de9c8690e20 100644 --- a/bfd/pdp11.c +++ b/bfd/pdp11.c @@ -2125,13 +2125,7 @@ NAME (aout, canonicalize_reloc) (bfd *abfd, long NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) { - bfd_size_type count; - - if (bfd_get_format (abfd) != bfd_object) - { - bfd_set_error (bfd_error_invalid_operation); - return -1; - } + size_t count, raw; if (asect->flags & SEC_CONSTRUCTOR) count = asect->reloc_count; @@ -2147,11 +2141,21 @@ NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) return -1; } - if (count >= LONG_MAX / sizeof (arelent *)) + if (count >= LONG_MAX / sizeof (arelent *) + || _bfd_mul_overflow (count, obj_reloc_entry_size (abfd), &raw)) { bfd_set_error (bfd_error_file_too_big); return -1; } + if (!bfd_write_p (abfd)) + { + ufile_ptr filesize = bfd_get_file_size (abfd); + if (filesize != 0 && raw > filesize) + { + bfd_set_error (bfd_error_file_truncated); + return -1; + } + } return (count + 1) * sizeof (arelent *); }