From patchwork Thu Aug 27 22:41:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142355 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 000934BA2E10 for ; Thu, 27 Aug 2026 22:48:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 000934BA2E10 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EejsrNu0 X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by sourceware.org (Postfix) with ESMTPS id E191C4BA901D for ; Thu, 27 Aug 2026 22:42:25 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E191C4BA901D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E191C4BA901D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870546; cv=none; b=c2AyT5lvOFhvMcOsB3KmxIQRiEcg9PAX8MyTLIBTa+Vw4Fas5gmWMZRXvZUUtAOTEBEtpPpT7S1Bi8QoRyECPcpLoOPq93vDGDHro2T/dRMUEBhU8I0OR1p3s431qPTh1BIAqQM3cxrQXIe7MFNmHSbhmgHoZS5QiQIDLSf8nQk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870546; c=relaxed/simple; bh=e5KUzNfd5/QBr5V9t4k8nSZmgVf+PCVSkXxsWoCsJew=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=bLrW61p2JWaYUTBu4Ip5hci7UWo8XpsUG+XtKKGNnmSGh5yerdfTgtaZ2QwC2aYH7bjzwH1zQWUDmJC7OR3zAhk2+4wWW2cg9kTe0pheNaUxOpBKmmNFm1o543+pdV+uZr+Q5qOMEqvgrZDlBcTnngZff1gv5/dsANFgNjINrYk= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EejsrNu0 DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E191C4BA901D Received: by mail-pj1-x102c.google.com with SMTP id 98e67ed59e1d1-382ef647e20so272480a91.1 for ; Thu, 27 Aug 2026 15:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870545; x=1788475345; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DeOAG6/mGtAxQtASDgZqQrSMSsewsqyh6nnNJlN6nfw=; b=EejsrNu04f7fT0sweiNFmdsZzZ79exAZizpY+OCdiWlE+MIXOE/Rev6l/ozcgh9lCQ VhcBXIrteLmcCSdGzQX3CCCSg/vH9lmCAMlOh0ZxEZqZjpsygWw3bPwtnIULs8nVY8SQ sYX/LFjijnd6ZqiKHpnrT1iQgyqqaO6iE0NfTTQL47/cBlapELeEsZ3Mja6DBE0AlYUT NBb11PdjIM62zmqBzel+mlkxiJEt32NeCXJ+quPrPuWZOeLqwGLisk0c5AgOlNexLObM E1WQAYK7OymxoJBec78BIpRM7U0zEOBS4kYZmIRCnWEOkUBLJGkhvLFoGrzGzBa6ZU1F nS2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870545; x=1788475345; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DeOAG6/mGtAxQtASDgZqQrSMSsewsqyh6nnNJlN6nfw=; b=DLpBVyc8f/L1X+6IfxdHjAeJrBZe6+JDqyk+uVGH1cF5lQ3T02eh9Dd2Aegsabv0kf g5dUyoZ43R4Dd3r1K3BH0cN4tkapaRWlW0leyv/5ceWk12Y/CzQ23vuzrNDTwWxE/dUN TSJzSbAfnX8syexHQ8ZFznm+qnbrk2YnsWgzZQc43zYeHIFOQ3mxRmp/8NwSYn31v1w5 jS+LiLsQrykP0U/27DPh0+vsPL3Cpo7SoDJdehLpqZ8TuKUNq/PWXsYnk6e3U1RfZpND cgXMXvfU+UTsE6faMz1cQyeZeG4ld6tyOr70FGIXdw88Lk7DXkWGxjn/KEl5U8QG1Ags LbGA== X-Gm-Message-State: AFuF++kBIgcCS+OSumnh64QLKO9mons630a2Qn7wIMw3hGl9ZRnVjmjh s1QvHH6i2DonNDbmy5jBc3GVLlbI0sUKnfqgctlzCbM9IVfzwvzw6cuQ4uVtKV6R X-Gm-Gg: AR+sD10hUYQLcDXOGJ4vUCag6cCnWziAXNPeNtj5K6H9qH3xQ4cpKGOEDD3MZe2najT pMzHOnmEThPCJRxg7G6Xp5TTKoZ4g1h8/fDNMxM5/9Yig3bWNENpayanI55mxaOFVC2B9S/U98k o2X9VzPcJI8lHJTeRmLIGwJyztg4/Pr+EsXcvZbUnXfVm0eUJGch1GzdDayiN8vRI5100uDD3TG U20wQQHYHKp6y9+1lQH3xDiKKD6kBYDmmrOrf9REE+zitt42g7N5+kiUCy+0X4/vWss0uKcDdfl lxt6MjYwq+xe/i6nYbWaNHLHW/hJ/MHI23wQD9Oz9/MpUs0IGcEXWEoHAWQMVAnGHZTBRWEnyNt YvqOwUsW5vXm7t0vBOhVOQQdevZpoBYt4aXCXHGp2AatRci+M1oEUulqPDSPO94rlX1sfmODhGR 4hkgCY6xg5Mf8s3a1Df7XbpYjKoDef//PC9RG7afrKAg== X-Received: by 2002:a17:90b:51c7:b0:38f:5801:dc0e with SMTP id 98e67ed59e1d1-396d0f52b2amr4654251a91.15.1787870544971; Thu, 27 Aug 2026 15:42:24 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:24 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 10/10] libsframe: fix PR libsframe/34417 Date: Thu, 27 Aug 2026 15:41:46 -0700 Message-ID: <20260827224146.3391610-11-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org For crafted SFrame data, malicious content in fre->fre_info may trigger a datawords_sz calculation to be > MAX_DATAWORD_BYTES. Check for bounds before memcpy. While at it, detect failure in the callers of sframe_decode_fre and return early. Reviewed-by: Jens Remus --- libsframe/sframe.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index d3af9717fe2..31ef751e1e1 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -1440,6 +1440,9 @@ sframe_decode_fre (const char *fre_buf, sframe_frame_row_entry *fre, memset (fre->fre_datawords, 0, MAX_DATAWORD_BYTES); /* Get offsets size. */ datawords_sz = sframe_fre_datawords_bytes_size (fre->fre_info); + if (datawords_sz > MAX_DATAWORD_BYTES) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); + datawords = fre_buf + addr_size + sizeof (fre->fre_info); memcpy (fre->fre_datawords, datawords, datawords_sz); @@ -1925,7 +1928,9 @@ sframe_decoder_get_fre (const sframe_decoder_ctx *ctx, for (i = 0; i < fdep->func_num_fres; i++) { /* Decode the FRE at the current position. Return it if valid. */ - err = sframe_decode_fre (fres, &ifre, fre_type, &esz); + if (sframe_decode_fre (fres, &ifre, fre_type, &esz)) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); + if (i == fre_idx) { if (!sframe_fre_sanity_check_p (&ifre)) @@ -2305,7 +2310,8 @@ sframe_encoder_add_fres_buf (sframe_encoder_ctx *ectx, { ectx_frep = &fre_tbl->entry[fre_tbl->count]; /* Copy the SFrame FRE data over to the encoder object's fre_tbl. */ - sframe_decode_fre (fres, ectx_frep, fre_type, &esz); + if (sframe_decode_fre (fres, ectx_frep, fre_type, &esz)) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); if (!sframe_fre_sanity_check_p (ectx_frep)) return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL);