patches/binutils/2.35/binutils-CVE-2020-35448.patch

   1 diff -rup binutils.orig/bfd/elf.c binutils-2.35/bfd/elf.c
   2 --- binutils.orig/bfd/elf.c     2021-04-19 10:49:21.757290990 +0100
   3 +++ binutils-2.35/bfd/elf.c     2021-04-19 10:50:28.309839285 +0100
   4 @@ -12534,7 +12534,9 @@ _bfd_elf_slurp_secondary_reloc_section (
   5        Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
   6
   7        if (hdr->sh_type == SHT_SECONDARY_RELOC
   8 -         && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
   9 +         && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
  10 +         && (hdr->sh_entsize == ebd->s->sizeof_rel
  11 +             || hdr->sh_entsize == ebd->s->sizeof_rela))
  12         {
  13           bfd_byte * native_relocs;
  14           bfd_byte * native_reloc;
  15 diff -rup binutils.orig/bfd/elfcode.h binutils-2.35/bfd/elfcode.h
  16 --- binutils.orig/bfd/elfcode.h 2021-04-19 10:49:21.767290922 +0100
  17 +++ binutils-2.35/bfd/elfcode.h 2021-04-19 10:52:22.196066303 +0100
  18 @@ -568,7 +568,7 @@ elf_object_p (bfd *abfd)
  19
  20    /* If this is a relocatable file and there is no section header
  21       table, then we're hosed.  */
  22 -  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
  23 +  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
  24      goto got_wrong_format_error;
  25
  26    /* As a simple sanity check, verify that what BFD thinks is the
  27 @@ -578,7 +578,7 @@ elf_object_p (bfd *abfd)
  28      goto got_wrong_format_error;
  29
  30    /* Further sanity check.  */
  31 -  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
  32 +  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
  33      goto got_wrong_format_error;
  34
  35    ebd = get_elf_backend_data (abfd);
  36 @@ -615,7 +615,7 @@ elf_object_p (bfd *abfd)
  37        && ebd->elf_osabi != ELFOSABI_NONE)
  38      goto got_wrong_format_error;
  39
  40 -  if (i_ehdrp->e_shoff != 0)
  41 +  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
  42      {
  43        file_ptr where = (file_ptr) i_ehdrp->e_shoff;
  44
  45 @@ -807,7 +807,7 @@ elf_object_p (bfd *abfd)
  46         }
  47      }
  48
  49 -  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
  50 +  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
  51      {
  52        unsigned int num_sec;
  53