http://sourceware.org/bugzilla/show_bug.cgi?id=15157
--- Comment #1 from Paul Marinescu <paul.marinescu at imperial dot ac.uk>
2013-02-19 16:12:26 UTC ---
I looked a bit more into this and it seems that the problem has to do with
handling of relocation offsets. More exactly, in readelf.c:10512, the code
checks for a invalid (too big) relocation offset:
rloc = start + rp->r_offset;
if ((rloc + reloc_size) > end)
{
warn (_("skipping invalid relocation offset 0x%lx in section %s\n"),
(unsigned long) rp->r_offset,
SECTION_NAME (section));
continue;
}
However, the code fails to take into account a value such as rp->r_offset =
(unsigned long)-5. One possible implication would be that a specially crafted
binary can make readelf write to any memory location below rloc.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
_______________________________________________
bug-binutils mailing list
bug-binutils@gnu.org
https://lists.gnu.org/mailman/listinfo/bug-binutils
