asan: readelf: heap buffer overflow in slurp_hppa_unwind_table

This one isn't just a weird corner case requiring multiple
.PARISC.unwind sections in an object file to trigger the buffer
overflow, it's also a simple bug that would prevent relocations being
applied in the normal case of a single .PARISC.unwind section.

	* readelf (slurp_hppa_unwind_table): Set table_len before use
	in relocation sanity checks.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 55a75afab5f315d9e755862e69d3d00e0f635c96..a5d6fad92cbeb17f62069bae8c97fcdc6932056e 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2020-07-09  Alan Modra  <amodra@gmail.com>
+
+       * readelf (slurp_hppa_unwind_table): Set table_len before use
+       in relocation sanity checks.
+
 2020-07-07  Alan Modra  <amodra@gmail.com>
 
        * testsuite/binutils-all/ar.exp: Use is_xcoff_format.

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 41547a2594b5a0c5a2e840d29475ed3c0c30ecf2..0feeed9831d2500cd2117611062c4c127e2e591b 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -8253,6 +8253,7 @@ slurp_hppa_unwind_table (Filedata *                  filedata,
   nentries = size / unw_ent_size;
   size = unw_ent_size * nentries;
 
+  aux->table_len = nentries;
   tep = aux->table = (struct hppa_unw_table_entry *)
       xcmalloc (nentries, sizeof (aux->table[0]));
 
@@ -8372,8 +8373,6 @@ slurp_hppa_unwind_table (Filedata *                  filedata,
       free (rela);
     }
 
-  aux->table_len = nentries;
-
   return TRUE;
 }