From patchwork Sun Apr 2 22:24:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 78310 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp1942274vqo; Sun, 2 Apr 2023 15:24:27 -0700 (PDT) X-Google-Smtp-Source: AKy350b1/etIuy7vebjCSnSp5jaIdoSQGlhvm8qjKDxusvIaG3ze572PwbhbR6dCav2OSco5+GYt X-Received: by 2002:a05:6402:386:b0:4ac:ce82:9825 with SMTP id o6-20020a056402038600b004acce829825mr31000708edv.16.1680474267656; Sun, 02 Apr 2023 15:24:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1680474267; cv=none; d=google.com; s=arc-20160816; b=huent1Dc2IqFEcF+XhYcFV1nuzKZxlX9dTThm+NPcCDthglY0H1FfnJtzU1mdJ9yR8 v9JtXV7+ko4IerfyDYFDa6Dte7E45IJPrNu0f8MarPx35RSu4hJmX0FJzB1InkbE5liF 9FCisHfmutpd6OB4rekPIIJAwOBom4jR+sZzK7vEtKiTmeCfIfmES7E1jobulb2GvwSy gUZzqu17SDqa/HWGsDHew//G+ZZMVTqOrD5UX2ZIZTgQewDP0tmJzbnWCtEXC7XcvbCn 6dgKYLic6RpmkAa1i5ztGI3UQ9ItyEvHspcDn5S6LdNTYDATbKVONLVUx9aEahog+9tt VPbw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-disposition:mime-version:message-id:subject:to:date :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=YzAkPrg0U9mDGqxmuM10AU7mNF7T5cuAQnXgO+NgR4I=; b=mKpcBUPWWGTwsScJmLAWHo2ksidQwNl04SlXDqTEKDMOtP+zYkWcq3BT/dHUIG5Rqr +WapSr48LXTrnWo1jQm6NWg5f5bzmnHk3HKv4ufWRt9Y1iTHSTKj+/QTWyMOeSrH5YF/ pvyOnxjmtJqUC9eGrFm7A/NbgN2nJMNXyfN0z9V2hVvLdHphVfq4o0oaytM5CngOnnzX C8dB5Js3+7xGeBX1TiwpY0SvW9enPr+yvPNas+L2bGsbMfAYICbpyoInJE0nnmDA8IhQ 3tOpUBZoXhYwldqMpS9bUzmFNhkLHQI8HzWZCd7fqWOlvZ5TLgT+/x1gGH8MLatX7I42 7SYA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=muNPD+dL; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id s14-20020aa7d78e000000b004fe95a9e4f6si6256338edq.493.2023.04.02.15.24.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Apr 2023 15:24:27 -0700 (PDT) Received-SPF: pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=muNPD+dL; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id A7F9F3858C50 for ; Sun, 2 Apr 2023 22:24:24 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A7F9F3858C50 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1680474264; bh=YzAkPrg0U9mDGqxmuM10AU7mNF7T5cuAQnXgO+NgR4I=; h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=muNPD+dL43o5wZrhtTwwScZFR9A2WbUA2xZhSdZo6jlXX05KGuj7BC4DQxJ9/ASF5 IXiLorFRJa3sbRY4jvytM9V2drHq9GajYzb9VxdsM1hp8W0Viuv0Un3Qv38j9z6j+p va0WdrDzdrzWwjXrV3XlDPermCat8nX0GRc3HOF0= X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) by sourceware.org (Postfix) with ESMTPS id 03FDD3858416 for ; Sun, 2 Apr 2023 22:24:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 03FDD3858416 Received: by mail-pj1-x102a.google.com with SMTP id q102so25461176pjq.3 for ; Sun, 02 Apr 2023 15:24:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680474254; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=YzAkPrg0U9mDGqxmuM10AU7mNF7T5cuAQnXgO+NgR4I=; b=L6K4afna13NDncBn93c+sDV+2PaChJhCmZnGY3lhfsUsxasg5TgK75jtM8mQTDFMLf +MUN7FGOgZ99vTnHeZfAkKG7BTvaK5AF0GXLaidkBYLU487RhTrjrvQXvidO0uzsGIgQ QUbzrHPhcP+zoLe7D1jcxp/5R9Q1enGs2lSyIDTr7nTGFe04OhhmP7MxKioIF4g0oHq6 wZzQSneKsOlYGbw+Cv8HWEEvD7OMYKgf91q+ubxqeIB9CMNoarlijUZ00RdXAkogeVA8 vfyNwDC2ld2VJUpHJL/j5h9mqHhqQj0EqUr/5yo1y82ATG6ACKM4wVqjKZfwg5fAxTwd Wm0Q== X-Gm-Message-State: AAQBX9cAZYm30U5jkH7sjYbT5XruJir5Gr0sbBHMK9GAHQ+qeYnuYjXV G7l+BmSgThu4Ul/filY7melzTiU+pmg= X-Received: by 2002:a17:902:f213:b0:19e:2869:7793 with SMTP id m19-20020a170902f21300b0019e28697793mr27899583plc.16.1680474254337; Sun, 02 Apr 2023 15:24:14 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id ik30-20020a170902ab1e00b0019f1264c7d7sm5193043plb.103.2023.04.02.15.24.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Apr 2023 15:24:13 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 6953C1142C55; Mon, 3 Apr 2023 07:54:11 +0930 (ACST) Date: Mon, 3 Apr 2023 07:54:11 +0930 To: binutils@sourceware.org Subject: asan: heap buffer overflow printing ecoff debug info file name Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3035.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Alan Modra via Binutils From: Alan Modra Reply-To: Alan Modra Errors-To: binutils-bounces+ouuuleilei=gmail.com@sourceware.org Sender: "Binutils" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1762104985656022012?= X-GMAIL-MSGID: =?utf-8?q?1762104985656022012?= A case of a string section ending with an unterminated string. Fix it by allocating one more byte and making it zero. Also make functions reading the data return void* so that casts are not needed. * ecoff.c (READ): Delete type param. Allocate one extra byte to terminate string sections with a NUL. Adjust invocation. * elfxx-mips.c (READ): Likewise. * libbfd-in.h (_bfd_alloc_and_read): Return a void*. (_bfd_malloc_and_read): Likewise. * libbfd.h: Regenerate. diff --git a/bfd/ecoff.c b/bfd/ecoff.c index 1bea7005fee..fb6fcade913 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -3749,7 +3749,7 @@ ecoff_final_link_debug_accumulate (bfd *output_bfd, HDRR *symhdr = &debug->symbolic_header; bool ret; -#define READ(ptr, offset, count, size, type) \ +#define READ(ptr, offset, count, size) \ do \ { \ size_t amt; \ @@ -3767,29 +3767,28 @@ ecoff_final_link_debug_accumulate (bfd *output_bfd, ret = false; \ goto return_something; \ } \ - debug->ptr = (type) _bfd_malloc_and_read (input_bfd, amt, amt); \ + debug->ptr = _bfd_malloc_and_read (input_bfd, amt + 1, amt); \ if (debug->ptr == NULL) \ { \ ret = false; \ goto return_something; \ } \ + ((char *) debug->ptr)[amt] = 0; \ } while (0) /* If raw_syments is not NULL, then the data was already by read by _bfd_ecoff_slurp_symbolic_info. */ if (ecoff_data (input_bfd)->raw_syments == NULL) { - READ (line, cbLineOffset, cbLine, sizeof (unsigned char), - unsigned char *); - READ (external_dnr, cbDnOffset, idnMax, swap->external_dnr_size, void *); - READ (external_pdr, cbPdOffset, ipdMax, swap->external_pdr_size, void *); - READ (external_sym, cbSymOffset, isymMax, swap->external_sym_size, void *); - READ (external_opt, cbOptOffset, ioptMax, swap->external_opt_size, void *); - READ (external_aux, cbAuxOffset, iauxMax, sizeof (union aux_ext), - union aux_ext *); - READ (ss, cbSsOffset, issMax, sizeof (char), char *); - READ (external_fdr, cbFdOffset, ifdMax, swap->external_fdr_size, void *); - READ (external_rfd, cbRfdOffset, crfd, swap->external_rfd_size, void *); + READ (line, cbLineOffset, cbLine, sizeof (unsigned char)); + READ (external_dnr, cbDnOffset, idnMax, swap->external_dnr_size); + READ (external_pdr, cbPdOffset, ipdMax, swap->external_pdr_size); + READ (external_sym, cbSymOffset, isymMax, swap->external_sym_size); + READ (external_opt, cbOptOffset, ioptMax, swap->external_opt_size); + READ (external_aux, cbAuxOffset, iauxMax, sizeof (union aux_ext)); + READ (ss, cbSsOffset, issMax, sizeof (char)); + READ (external_fdr, cbFdOffset, ifdMax, swap->external_fdr_size); + READ (external_rfd, cbRfdOffset, crfd, swap->external_rfd_size); } #undef READ diff --git a/bfd/elfxx-mips.c b/bfd/elfxx-mips.c index 35bbd86044b..d34a755807b 100644 --- a/bfd/elfxx-mips.c +++ b/bfd/elfxx-mips.c @@ -1486,7 +1486,7 @@ _bfd_mips_elf_read_ecoff_info (bfd *abfd, asection *section, /* The symbolic header contains absolute file offsets and sizes to read. */ -#define READ(ptr, offset, count, size, type) \ +#define READ(ptr, offset, count, size) \ do \ { \ size_t amt; \ @@ -1500,23 +1500,23 @@ _bfd_mips_elf_read_ecoff_info (bfd *abfd, asection *section, } \ if (bfd_seek (abfd, symhdr->offset, SEEK_SET) != 0) \ goto error_return; \ - debug->ptr = (type) _bfd_malloc_and_read (abfd, amt, amt); \ + debug->ptr = _bfd_malloc_and_read (abfd, amt + 1, amt); \ if (debug->ptr == NULL) \ goto error_return; \ + ((char *) debug->ptr)[amt] = 0; \ } while (0) - READ (line, cbLineOffset, cbLine, sizeof (unsigned char), unsigned char *); - READ (external_dnr, cbDnOffset, idnMax, swap->external_dnr_size, void *); - READ (external_pdr, cbPdOffset, ipdMax, swap->external_pdr_size, void *); - READ (external_sym, cbSymOffset, isymMax, swap->external_sym_size, void *); - READ (external_opt, cbOptOffset, ioptMax, swap->external_opt_size, void *); - READ (external_aux, cbAuxOffset, iauxMax, sizeof (union aux_ext), - union aux_ext *); - READ (ss, cbSsOffset, issMax, sizeof (char), char *); - READ (ssext, cbSsExtOffset, issExtMax, sizeof (char), char *); - READ (external_fdr, cbFdOffset, ifdMax, swap->external_fdr_size, void *); - READ (external_rfd, cbRfdOffset, crfd, swap->external_rfd_size, void *); - READ (external_ext, cbExtOffset, iextMax, swap->external_ext_size, void *); + READ (line, cbLineOffset, cbLine, sizeof (unsigned char)); + READ (external_dnr, cbDnOffset, idnMax, swap->external_dnr_size); + READ (external_pdr, cbPdOffset, ipdMax, swap->external_pdr_size); + READ (external_sym, cbSymOffset, isymMax, swap->external_sym_size); + READ (external_opt, cbOptOffset, ioptMax, swap->external_opt_size); + READ (external_aux, cbAuxOffset, iauxMax, sizeof (union aux_ext)); + READ (ss, cbSsOffset, issMax, sizeof (char)); + READ (ssext, cbSsExtOffset, issExtMax, sizeof (char)); + READ (external_fdr, cbFdOffset, ifdMax, swap->external_fdr_size); + READ (external_rfd, cbRfdOffset, crfd, swap->external_rfd_size); + READ (external_ext, cbExtOffset, iextMax, swap->external_ext_size); #undef READ return true; diff --git a/bfd/libbfd-in.h b/bfd/libbfd-in.h index 1c9f34bb6d7..561cef1a12e 100644 --- a/bfd/libbfd-in.h +++ b/bfd/libbfd-in.h @@ -929,10 +929,10 @@ extern bool _bfd_link_keep_memory (struct bfd_link_info *) #define _bfd_constant_p(v) 0 #endif -static inline bfd_byte * +static inline void * _bfd_alloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) { - bfd_byte *mem; + void *mem; if (!_bfd_constant_p (rsize)) { ufile_ptr filesize = bfd_get_file_size (abfd); @@ -952,10 +952,10 @@ _bfd_alloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) return NULL; } -static inline bfd_byte * +static inline void * _bfd_malloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) { - bfd_byte *mem; + void *mem; if (!_bfd_constant_p (rsize)) { ufile_ptr filesize = bfd_get_file_size (abfd); diff --git a/bfd/libbfd.h b/bfd/libbfd.h index d1dc7b912a0..ae17717efa3 100644 --- a/bfd/libbfd.h +++ b/bfd/libbfd.h @@ -935,10 +935,10 @@ extern bool _bfd_link_keep_memory (struct bfd_link_info *) #define _bfd_constant_p(v) 0 #endif -static inline bfd_byte * +static inline void * _bfd_alloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) { - bfd_byte *mem; + void *mem; if (!_bfd_constant_p (rsize)) { ufile_ptr filesize = bfd_get_file_size (abfd); @@ -958,10 +958,10 @@ _bfd_alloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) return NULL; } -static inline bfd_byte * +static inline void * _bfd_malloc_and_read (bfd *abfd, bfd_size_type asize, bfd_size_type rsize) { - bfd_byte *mem; + void *mem; if (!_bfd_constant_p (rsize)) { ufile_ptr filesize = bfd_get_file_size (abfd);