Fix excessive memory allocation attempts and possible integer overfloaws when attempt...

[deliverable/binutils-gdb.git] / bfd / versados.c

diff --git a/bfd/versados.c b/bfd/versados.c
index 1dfe7483778eed702507633e9a9b85ef8d2d64d7..d9ede273d76622510017a9142acf2dc93f7036ae 100644 (file)
--- a/bfd/versados.c
+++ b/bfd/versados.c
@@ -1,5 +1,5 @@
 /* BFD back-end for VERSAdos-E objects.
-   Copyright (C) 1995-2014 Free Software Foundation, Inc.
+   Copyright (C) 1995-2017 Free Software Foundation, Inc.
    Written by Steve Chamberlain of Cygnus Support <sac@cygnus.com>.
 
    Versados is a Motorola trademark.
@@ -57,6 +57,7 @@ struct esdid
 {
   asection *section;           /* Ptr to bfd version.  */
   unsigned char *contents;     /* Used to build image.  */
+  bfd_size_type content_size;  /* The size of the contents buffer.  */
   int pc;
   int relocs;                  /* Reloc count, valid end of pass 1.  */
   int donerel;                 /* Have relocs been translated.  */
@@ -148,7 +149,7 @@ versados_mkobject (bfd *abfd)
   if (abfd->tdata.versados_data == NULL)
     {
       bfd_size_type amt = sizeof (tdata_type);
-      tdata_type *tdata = bfd_alloc (abfd, amt);
+      tdata_type *tdata = bfd_zalloc (abfd, amt);
 
       if (tdata == NULL)
        return FALSE;
@@ -295,6 +296,7 @@ process_esd (bfd *abfd, struct ext_esd *esd, int pass)
          break;
        case ESD_XDEF_IN_ABS:
          sec = bfd_abs_section_ptr;
+         /* Fall through.  */
        case ESD_XDEF_IN_SEC:
          {
            int snum = VDATA (abfd)->def_idx++;
@@ -343,13 +345,13 @@ reloc_howto_type versados_howto_table[] =
 };
 
 static int
-get_offset (int len, unsigned char *ptr)
+get_offset (unsigned int len, unsigned char *ptr)
 {
   int val = 0;
 
   if (len)
     {
-      int i;
+      unsigned int i;
 
       val = *ptr++;
       if (val & 0x80)
@@ -372,10 +374,18 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
   | (otr->map[2] << 8)
   | (otr->map[3] << 0);
 
-  struct esdid *esdid = &EDATA (abfd, otr->esdid - 1);
-  unsigned char *contents = esdid->contents;
+  struct esdid *esdid;
+  unsigned char *contents;
   bfd_boolean need_contents = FALSE;
-  unsigned int dst_idx = esdid->pc;
+  unsigned int dst_idx;
+
+  /* PR 17512: file: ac7da425.  */
+  if (otr->esdid == 0)
+    return;
+
+  esdid = &EDATA (abfd, otr->esdid - 1);
+  contents = esdid->contents;
+  dst_idx = esdid->pc;
 
   for (shift = ((unsigned long) 1 << 31); shift && srcp < endp; shift >>= 1)
     {
@@ -384,9 +394,13 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
          int flag = *srcp++;
          int esdids = (flag >> 5) & 0x7;
          int sizeinwords = ((flag >> 3) & 1) ? 2 : 1;
-         int offsetlen = flag & 0x7;
+         unsigned int offsetlen = flag & 0x7;
          int j;
 
+         /* PR 21591: Check for invalid lengths.  */
+         if (srcp + esdids + offsetlen >= endp)
+           return;
+
          if (esdids == 0)
            {
              /* A zero esdid means the new pc is the offset given.  */
@@ -399,7 +413,7 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
 
              if (pass == 1)
                need_contents = TRUE;
-             else if (contents)
+             else if (contents && dst_idx < esdid->content_size - sizeinwords * 2)
                for (j = 0; j < sizeinwords * 2; j++)
                  {
                    contents[dst_idx + (sizeinwords * 2) - j - 1] = val;
@@ -421,10 +435,13 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
                        }
                      else
                        {
-                         arelent *n =
-                         EDATA (abfd, otr->esdid - 1).section->relocation + rn;
-                         n->address = dst_idx;
+                         arelent *n;
 
+                         /* PR 17512: file: 54f733e0.  */
+                         if (EDATA (abfd, otr->esdid - 1).section == NULL)
+                           continue;
+                         n = EDATA (abfd, otr->esdid - 1).section->relocation + rn;
+                         n->address = dst_idx;
                          n->sym_ptr_ptr = (asymbol **) (size_t) id;
                          n->addend = 0;
                          n->howto = versados_howto_table + ((j & 1) * 2) + (sizeinwords - 1);
@@ -439,7 +456,7 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
        {
          need_contents = TRUE;
 
-         if (esdid->section && contents && dst_idx < esdid->section->size)
+         if (esdid->section && contents && dst_idx < esdid->content_size - 1)
            if (pass == 2)
              {
                /* Absolute code, comes in 16 bit lumps.  */
@@ -462,6 +479,7 @@ process_otr (bfd *abfd, struct ext_otr *otr, int pass)
 
          size = esdid->section->size;
          esdid->contents = bfd_alloc (abfd, size);
+         esdid->content_size = size;
        }
       else
        esdid->contents = NULL;
@@ -676,12 +694,20 @@ versados_get_section_contents (bfd *abfd,
                               file_ptr offset,
                               bfd_size_type count)
 {
+  struct esdid *esdid;
+
   if (!versados_pass_2 (abfd))
     return FALSE;
 
-  memcpy (location,
-         EDATA (abfd, section->target_index).contents + offset,
-         (size_t) count);
+  esdid = &EDATA (abfd, section->target_index);
+
+  if (esdid->contents == NULL
+      || offset < 0
+      || (bfd_size_type) offset > esdid->content_size
+      || offset + count > esdid->content_size)
+    return FALSE;
+
+  memcpy (location, esdid->contents + offset, (size_t) count);
 
   return TRUE;
 }
@@ -798,7 +824,11 @@ versados_canonicalize_reloc (bfd *abfd,
              /* Section relative thing.  */
              struct esdid *e = &EDATA (abfd, esdid - 1);
 
-             src[count].sym_ptr_ptr = e->section->symbol_ptr_ptr;
+             /* PR 17512: file:cd92277c.  */
+             if (e->section)
+               src[count].sym_ptr_ptr = e->section->symbol_ptr_ptr;
+             else
+               src[count].sym_ptr_ptr = bfd_und_section_ptr->symbol_ptr_ptr;
            }
          /* PR 17512: file:3757-2936-0.004.  */
          else if ((unsigned) (esdid - ES_BASE) >= bfd_get_symcount (abfd))
@@ -841,6 +871,7 @@ versados_canonicalize_reloc (bfd *abfd,
 #define versados_bfd_discard_group                    bfd_generic_discard_group
 #define versados_section_already_linked               _bfd_generic_section_already_linked
 #define versados_bfd_define_common_symbol             bfd_generic_define_common_symbol
+#define versados_bfd_define_start_stop                bfd_generic_define_start_stop
 #define versados_bfd_link_hash_table_create           _bfd_generic_link_hash_table_create
 #define versados_bfd_link_add_symbols                 _bfd_generic_link_add_symbols
 #define versados_bfd_link_just_syms                   _bfd_generic_link_just_syms
@@ -848,6 +879,8 @@ versados_canonicalize_reloc (bfd *abfd,
   _bfd_generic_copy_link_hash_symbol_type
 #define versados_bfd_final_link                       _bfd_generic_final_link
 #define versados_bfd_link_split_section               _bfd_generic_link_split_section
+#define versados_bfd_link_check_relocs                _bfd_generic_link_check_relocs
+#define versados_set_reloc                           _bfd_generic_set_reloc
 
 const bfd_target m68k_versados_vec =
 {