bfd: validate COFF and XCOFF symbol tables before linker walks them
Patch validates COFF and XCOFF symbol tables to prevent heap writes caused by out-of-bounds access.
This patch addresses heap buffer overflows in binutils’ COFF and XCOFF linkers by validating symbol tables before they are processed. Specifically, it corrects issues where a symbol’s auxiliary entries could point beyond the allocated buffer, leading to out-of-bounds writes, and aims to harden unvalidated paths present in generic COFF and XCOFF linking.
- proposer
Proposes validating COFF and XCOFF symbol tables to prevent heap writes caused by incorrect auxiliary entry counts. The patch addresses specific unvalidated paths in XCOFF linking and strengthens generic COFF linker paths.
In Details
This patch in binutils/bfd (specifically affecting cofflink.c and xcofflink.c) addresses potential heap buffer overflows. The issue arises when processing COFF and XCOFF symbol tables, where n_numaux can cause out-of-bounds reads/writes into state arrays like sym_hashes and sym_indices if not properly validated. The patch aims to rectify this by adding explicit checks before the linker walks these tables, building on previous hardening efforts.
- bfd
- The Binary File Descriptor library, a low-level library used by binutils to parse and manipulate object files and executables.
- COFF
- Common Object File Format, a file format for executables, object code, and shared libraries on Unix-like systems, and older versions of Windows.
- XCOFF
- An extended version of COFF, primarily used on IBM's AIX operating system. It includes additional information for debugging and linking.
- symbol table
- A data structure used by linkers and debuggers to store information about symbols (variables, functions, etc.) defined in an object file.
- n_numaux
- A field in a COFF symbol entry that specifies the number of auxiliary entries following the main symbol entry. These auxiliary entries provide additional information about the symbol.
- heap writes
- Writing data to the heap, a region of memory used for dynamic memory allocation. Out-of-bounds writes can corrupt other data or lead to crashes.