asan: ppc64_elf_get_synthetic_symtab heap buffer overflowlinaro-local/ci/tcwg_kernel/llvm-master-arm-norov-allnoconfiglinaro-local/ci/tcwg_kernel/llvm-master-aarch64-norov-allnoconfiglinaro-local/ci/tcwg_kernel/gnu-master-aarch64-norov-defconfig

Fuzzed input files with sizes of .dynamic not a multiple of dynamic
tag size can result in reading past the end of the buffer with the
current simple checks.  Fix that, and use the same check in other
files that process input object .dynamic section.  (There is no need
for buffer overflow checks in the linker's generated .dynamic
section.)

	* elf32-ppc.c (ppc_elf_get_synthetic_symtab): Sanity check
	.dynamic content buffer reads.
	* elf64-ppc.c (ppc64_elf_get_synthetic_symtab): Likewise.
	* elf64-ia64-vms.c (elf64_vms_link_add_object_symbols): Likewise.
	* elf.c (_bfd_elf_print_private_bfd_data): Simplify .dynamic
	buffer sanity checks.
	* elflink.c (elf_link_add_object_symbols): Avoid possible UB
	subtracting sizeof_dyn from pointer.

1 files changed, 3 insertions, 8 deletions

diff --git a/bfd/elf.c b/bfd/elf.c
index 346eea39b1..1b9b7fad15 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -1721,14 +1721,9 @@ _bfd_elf_print_private_bfd_data (bfd *abfd, void *farg)
       extdynsize = get_elf_backend_data (abfd)->s->sizeof_dyn;
       swap_dyn_in = get_elf_backend_data (abfd)->s->swap_dyn_in;
 
-      extdyn = dynbuf;
-      /* PR 17512: file: 6f427532.  */
-      if (s->size < extdynsize)
-	goto error_return;
-      extdynend = extdyn + s->size;
-      /* PR 17512: file: id:000006,sig:06,src:000000,op:flip4,pos:5664.
-	 Fix range check.  */
-      for (; extdyn <= (extdynend - extdynsize); extdyn += extdynsize)
+      for (extdyn = dynbuf, extdynend = dynbuf + s->size;
+	   (size_t) (extdynend - extdyn) >= extdynsize;
+	   extdyn += extdynsize)
 	{
 	  Elf_Internal_Dyn dyn;
 	  const char *name = "";