/usr/src/binutils/patches/pr22741.diff is in binutils-source 2.30-15ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | # DP: PR22741, objcopy segfault on fuzzed COFF object
From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sat, 27 Jan 2018 08:19:33 +1030
Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object
PR 22741
* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
range before converting to a symbol table pointer.
---
bfd/ChangeLog | 6 ++++++
bfd/coffgen.c | 3 ++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b241087..4f90ead 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
}
/* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
generate one, so we must be careful to ignore it. */
- if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+ if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+ < obj_raw_syment_count (abfd))
{
auxent->u.auxent.x_sym.x_tagndx.p =
table_base + auxent->u.auxent.x_sym.x_tagndx.l;
--
2.9.3
|