Fix buffer overflow in ECOFF section writing that mirrors COFF hardening.
ECOFF's section-write path gets the same anti-fuzzer bounds checks already applied to COFF, closing a buffer overflow.
The ECOFF back-end’s _bfd_ecoff_set_section_contents function lacked the sanity checks already present in the COFF equivalent, leaving a buffer-overflow vector exposed to malformed input. Alan Modra unified the guards by rewriting COFF’s check to avoid run-time division and applying the same logic to ECOFF. Fuzzers routinely craft sections with absurd sizes or offsets to trip linkers and disassemblers, so this tightening prevents crashes or security issues during object-file write operations. The fix references commit ef186fe54aa6, which introduced COFF’s original defenses, and closes PR 29482.
In Details
BFD's set_section_contents hook writes raw data into an in-memory section buffer before the back-end serializes the object file to disk; each format (COFF, ECOFF, ELF) implements its own hook. Fuzzers exploit the gap between the generic BFD layer and format-specific back-ends by passing offsets or counts that overflow when multiplied or added, bypassing higher-level checks. ECOFF (Extended COFF, used by early MIPS and Alpha systems) shares much of COFF's structure but lives in a separate source file, so hardening applied to coffcode.h doesn't automatically propagate. This commit closes th…
- BFD
- Binary File Descriptor library—the format-agnostic object-file abstraction inside binutils. It presents a unified front-end API to tools like
ldandobjcopy, with back-ends that translate to COFF, ELF, Mach-O, and other formats. Each back-end implements hooks (e.g.,set_section_contents) that the front-end calls without needing to know the on-disk layout. - COFF
- Common Object File Format—a structured binary format with a file header, section table, and symbol table, originally from Unix System V. Each section record holds a file offset, size, and flags; linkers and loaders parse these fields to locate code and data.
- ECOFF
- Extended COFF—a derivative of COFF used by DEC/Compaq MIPS and Alpha systems. It adds symbol and debug-info tables (the "symbolic header") but retains COFF's section-table layout. Because it predates ELF on those architectures, legacy binaries still surface in embedded and retrocomputing contexts.
- set_section_contents
- A BFD back-end hook that copies user data into a section's in-memory buffer at a given offset. The front-end has already allocated space; the hook validates offset and count against the section's declared size before memcpy. Malformed objects can pass bogus values that overflow offset arithmetic or exceed the buffer.
- anti-fuzzer sanity check
- Bounds validation inserted to catch inputs—typically from fuzzing tools like AFL or libFuzzer—that exploit integer overflow or wrap-around in size and offset calculations. These checks often use saturating arithmetic or compare against maximum file size to reject values that would cause out-of-bounds writes.