From patchwork Mon Sep 8 12:45:55 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 119766 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5C5E33858D35 for ; Mon, 8 Sep 2025 13:06:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5C5E33858D35 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=bbLu0c/M X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) by sourceware.org (Postfix) with ESMTPS id A94413858D1E for ; Mon, 8 Sep 2025 12:45:59 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A94413858D1E Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A94413858D1E Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1035 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1757335559; cv=none; b=hIXLuuGm0ACKzfvlobVl7lEpj2GMU2xwN6gMyl0tuGarEAypXynul4BdzR3dDNh8BaU/1qrXNPh65ueEZCbT6c7kAv0quQBXRbX0iddsoGFlWPkufUzQR0ORZ5BLmnizEdRh75F+MiokXa/ZUXYEdZIKCNfrN0j4R3bu4ZVHNvw= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1757335559; c=relaxed/simple; bh=nzJsKHdbnpKTozGTVtZN1W3pHoP9pS3s3T77q5d6ocE=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=tPh8ysrdXvzkVB9NHwL4dgBBxslGLO3HWtXAj+1q/YlXiEF4zgt/NdqS+QrlSK72yZU9sAnS0vppbAMZjq5XT76Cz5IUCQ1Yqdq2H/xIhjB3fstJDEoyJgwYwrUarjQ0ECXe178k/tK/UzwWGlaVwmqducGy9OGRTZqVL2u1zFA= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pj1-x1035.google.com with SMTP id 98e67ed59e1d1-32b6108f2d5so3071150a91.3 for ; Mon, 08 Sep 2025 05:45:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1757335558; x=1757940358; darn=sourceware.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=oFYjBIje1i9OTJJsI8x5JLgnMkfo/spJS+/2+myrbzY=; b=bbLu0c/Mey+ALs18dWpyWkGET5vgsbdqbafc+kU1G3E7czNGn1j2iTasH4yQ4Uo2Lw oiv8J8bqrEZbVPaQHRjZ/V1ofCe61Zw1/+O1CK88xsIYC8xVvfDXv9902BuVzIpcnPQ1 9zvVZpDYdUe6j9XIHLiG3w9/10aXma7BCjMExZZjAdalW2cLm1w7RMZPAe1fBthOawPX Xdv5WBi79unWUdOkwF9rK+c/fgACG3i7Kl3Gh3MN273dsYbnrZvZkDhSwQQqNcfM5o6n t2leseaqv0Lq2ahsAbB4GLaRwQf7kUhO+ngAbEwml7E54fDUmDEzRyEY0FHuJBZLB+Y/ 6maw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1757335558; x=1757940358; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=oFYjBIje1i9OTJJsI8x5JLgnMkfo/spJS+/2+myrbzY=; b=Y3t+g4l4YF+XgUG2lT0xOxuIXSI+B76eCn4U0CmvQZAsh4leSwzOxOvvL6mTFiod6x e0k0zAB3CG28LtCrNeF/t6dFUbSQXcwckyl2EJN/Z7vCnV8QvUk9sdhK/HfadBnA73SD +qUZe2we5ssA34BG5rn39tQbJ9GmIHfsehFjCRoU//mmwoS14F5hCK/vlr6MJj2hTLej SItSxOCuUKuwMD88oSoKwiCoTMf4TyqxOb8PSLuUyHqg6kjIHNerrn3YyIzTfkuXn5Wy Ldc9uC4BMkRSVALGEXjIWHNe75k8J23HjlHuBuvqSmybW8neO6cbjSny3T/kz61vYWkT OtYw== X-Gm-Message-State: AOJu0YwZTMpyXRzqVjKmYYQsseWJueUcDbE8jch1GTFy/R0mHwrSAKsP FnacyosEHl1rOlJ08/6X036Nh1OXXyXZ7UqMa7OZX6uIYjBjl9j/Ah5QBMZwQA== X-Gm-Gg: ASbGncv2+BkyMgJXb/WVwI6RcZp62sbuEm9jJoztpM7vQxaMUs7FhqwFF907ROK+kH2 1yMhaOReTu/brG1ZYGT2fLJHzkR2pZ2G9+N2kwdNLHOsj7dixJZCNkT8tr2twRMPV822LK4lSW0 m4qJZc41DEPtx6s/rhR2VmnDOyFNvt38okgZFtfoKBo+FkHZgdqK9nZRLJsc/1Ub8bkhTVO9jry /lO8UESLP7iBu7OAeLgoqu+YjdOX9x28crub4Qr9KC6rAsczMHv/7Piel99rSeCutanWouHXie3 K/MvOldSrlhulQqX9lQmvDFbtEkDNnoXaXr9DUWdn+0Sa7PjjeklQvWYK4gwILS1PX+BJRbM6+Z 9gm9PL99+gYqlZmfJv0k/QQREHks3JGdhsiVa/2TO2vy1inJZ2ZqupTxwEM+uJSnGBLMxwZwkXE nENXsDeD964wBNVQ== X-Google-Smtp-Source: AGHT+IFCHawcBBuJYPQE593GAy+kLC6+iWvtwvP+ePOrm8yz+NvSqJAwVEmtJ8xVUI4oAdYa/I4FbQ== X-Received: by 2002:a17:90b:48cc:b0:32b:6145:fa67 with SMTP id 98e67ed59e1d1-32d43ef52fcmr9615595a91.2.1757335558192; Mon, 08 Sep 2025 05:45:58 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-32b5d95709fsm16247141a91.10.2025.09.08.05.45.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Sep 2025 05:45:57 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 6358611426CA; Mon, 08 Sep 2025 22:15:55 +0930 (ACST) Date: Mon, 8 Sep 2025 22:15:55 +0930 From: Alan Modra To: binutils@sourceware.org Subject: vms-alpha: ehdr checks Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Spam-Status: No, score=-3031.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org I noticed that _bfd_vms_slurp_ehdr wrongly used buf_size (rather than rec_size) when sanity checking. * vms-alpha.c (_bfd_vms_slurp_ehdr): Don't allow access to uninitialised buffer memory. Tidy code generally, using remaining record length for sanity checks. diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c index 80a559dabed..f8eaf6f3559 100644 --- a/bfd/vms-alpha.c +++ b/bfd/vms-alpha.c @@ -892,65 +892,64 @@ static bool _bfd_vms_slurp_ehdr (bfd *abfd) { unsigned char *ptr; - unsigned char *vms_rec; - unsigned char *end; + unsigned int len, slen; int subtype; - vms_rec = PRIV (recrd.rec); - /* PR 17512: file: 62736583. */ - end = PRIV (recrd.buf) + PRIV (recrd.buf_size); - vms_debug2 ((2, "HDR/EMH\n")); - subtype = bfd_getl16 (vms_rec + 4); + ptr = PRIV (recrd.rec); + len = PRIV (recrd.rec_size); + if (len < 6) + goto fail; + + subtype = bfd_getl16 (ptr + 4); vms_debug2 ((3, "subtype %d\n", subtype)); + ptr += 6; + len -= 6; switch (subtype) { case EMH__C_MHD: /* Module header. */ - if (vms_rec + 21 >= end) - goto fail; - PRIV (hdr_data).hdr_b_strlvl = vms_rec[6]; - PRIV (hdr_data).hdr_l_arch1 = bfd_getl32 (vms_rec + 8); - PRIV (hdr_data).hdr_l_arch2 = bfd_getl32 (vms_rec + 12); - PRIV (hdr_data).hdr_l_recsiz = bfd_getl32 (vms_rec + 16); - if ((vms_rec + 20 + vms_rec[20] + 1) >= end) + if (len < 15) goto fail; + PRIV (hdr_data).hdr_b_strlvl = *ptr; + PRIV (hdr_data).hdr_l_arch1 = bfd_getl32 (ptr + 2); + PRIV (hdr_data).hdr_l_arch2 = bfd_getl32 (ptr + 6); + PRIV (hdr_data).hdr_l_recsiz = bfd_getl32 (ptr + 10); + ptr += 14; + len -= 14; PRIV (hdr_data).hdr_t_name - = _bfd_vms_save_counted_string (abfd, vms_rec + 20, vms_rec[20]); - ptr = vms_rec + 20 + vms_rec[20] + 1; - if ((ptr + *ptr + 1) >= end) + = _bfd_vms_save_counted_string (abfd, ptr, len); + slen = *ptr + 1; + if (len <= slen) goto fail; + ptr += slen; + len -= slen; PRIV (hdr_data).hdr_t_version - = _bfd_vms_save_counted_string (abfd, ptr, *ptr); - ptr += *ptr + 1; - if (ptr + 17 >= end) + = _bfd_vms_save_counted_string (abfd, ptr, len); + slen = *ptr + 1; + if (len < slen + 17) goto fail; + ptr += slen; PRIV (hdr_data).hdr_t_date = _bfd_vms_save_sized_string (abfd, ptr, 17); break; case EMH__C_LNM: - if (vms_rec + PRIV (recrd.rec_size - 6) > end) - goto fail; PRIV (hdr_data).hdr_c_lnm - = _bfd_vms_save_sized_string (abfd, vms_rec, PRIV (recrd.rec_size - 6)); + = _bfd_vms_save_sized_string (abfd, ptr, len); break; case EMH__C_SRC: - if (vms_rec + PRIV (recrd.rec_size - 6) > end) - goto fail; PRIV (hdr_data).hdr_c_src - = _bfd_vms_save_sized_string (abfd, vms_rec, PRIV (recrd.rec_size - 6)); + = _bfd_vms_save_sized_string (abfd, ptr, len); break; case EMH__C_TTL: - if (vms_rec + PRIV (recrd.rec_size - 6) > end) - goto fail; PRIV (hdr_data).hdr_c_ttl - = _bfd_vms_save_sized_string (abfd, vms_rec, PRIV (recrd.rec_size - 6)); + = _bfd_vms_save_sized_string (abfd, ptr, len); break; case EMH__C_CPR: