summaryrefslogtreecommitdiff
path: root/system/binutils/CVE-2017-7614.patch
blob: 5f3b550f2633da070855461f77a3d4cd7e43c8cb (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
From ad32986fdf9da1c8748e47b8b45100398223dba8 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Tue, 4 Apr 2017 11:23:36 +0100
Subject: [PATCH] Fix null pointer dereferences when using a link built with
 clang.

	PR binutils/21342
	* elflink.c (_bfd_elf_define_linkage_sym): Prevent null pointer
	dereference.
	(bfd_elf_final_link): Only initialize the extended symbol index
	section if there are extended symbol tables to list.
---
 bfd/elflink.c | 35 +++++++++++++++++++++--------------
 2 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/bfd/elflink.c b/bfd/elflink.c
index 776357f..9bf75c8 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -119,15 +119,18 @@ _bfd_elf_define_linkage_sym (bfd *abfd,
 	 defined in shared libraries can't be overridden, because we
 	 lose the link to the bfd which is via the symbol section.  */
       h->root.type = bfd_link_hash_new;
+      bh = &h->root;
     }
+  else
+    bh = NULL;
 
-  bh = &h->root;
   bed = get_elf_backend_data (abfd);
   if (!_bfd_generic_link_add_one_symbol (info, abfd, name, BSF_GLOBAL,
 					 sec, 0, NULL, FALSE, bed->collect,
 					 &bh))
     return NULL;
   h = (struct elf_link_hash_entry *) bh;
+  BFD_ASSERT (h != NULL);
   h->def_regular = 1;
   h->non_elf = 0;
   h->root.linker_def = 1;
@@ -12038,24 +12041,28 @@ bfd_elf_final_link (bfd *abfd, struct bfd_link_info *info)
     {
       /* Finish up and write out the symbol string table (.strtab)
 	 section.  */
-      Elf_Internal_Shdr *symstrtab_hdr;
+      Elf_Internal_Shdr *symstrtab_hdr = NULL;
       file_ptr off = symtab_hdr->sh_offset + symtab_hdr->sh_size;
 
-      symtab_shndx_hdr = & elf_symtab_shndx_list (abfd)->hdr;
-      if (symtab_shndx_hdr != NULL && symtab_shndx_hdr->sh_name != 0)
+      if (elf_symtab_shndx_list (abfd))
 	{
-	  symtab_shndx_hdr->sh_type = SHT_SYMTAB_SHNDX;
-	  symtab_shndx_hdr->sh_entsize = sizeof (Elf_External_Sym_Shndx);
-	  symtab_shndx_hdr->sh_addralign = sizeof (Elf_External_Sym_Shndx);
-	  amt = bfd_get_symcount (abfd) * sizeof (Elf_External_Sym_Shndx);
-	  symtab_shndx_hdr->sh_size = amt;
+	  symtab_shndx_hdr = & elf_symtab_shndx_list (abfd)->hdr;
 
-	  off = _bfd_elf_assign_file_position_for_section (symtab_shndx_hdr,
-							   off, TRUE);
+	  if (symtab_shndx_hdr != NULL && symtab_shndx_hdr->sh_name != 0)
+	    {
+	      symtab_shndx_hdr->sh_type = SHT_SYMTAB_SHNDX;
+	      symtab_shndx_hdr->sh_entsize = sizeof (Elf_External_Sym_Shndx);
+	      symtab_shndx_hdr->sh_addralign = sizeof (Elf_External_Sym_Shndx);
+	      amt = bfd_get_symcount (abfd) * sizeof (Elf_External_Sym_Shndx);
+	      symtab_shndx_hdr->sh_size = amt;
 
-	  if (bfd_seek (abfd, symtab_shndx_hdr->sh_offset, SEEK_SET) != 0
-	      || (bfd_bwrite (flinfo.symshndxbuf, amt, abfd) != amt))
-	    return FALSE;
+	      off = _bfd_elf_assign_file_position_for_section (symtab_shndx_hdr,
+							       off, TRUE);
+
+	      if (bfd_seek (abfd, symtab_shndx_hdr->sh_offset, SEEK_SET) != 0
+		  || (bfd_bwrite (flinfo.symshndxbuf, amt, abfd) != amt))
+		return FALSE;
+	    }
 	}
 
       symstrtab_hdr = &elf_tdata (abfd)->strtab_hdr;
-- 
2.9.3