[Bug binutils/16825] New: bfd/versados.c: Multiple failures to validate user input

[klemensbaum at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16825

            Bug ID: 16825
           Summary: bfd/versados.c: Multiple failures to validate user
                    input
           Product: binutils
           Version: 2.25 (HEAD)
            Status: NEW
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: klemensbaum at gmail dot com

bfd/versados.c:188 get_record
  Failure to validate size allows writing of an arbitrary byte after the
structure.

bfd/versados.c:367 process_otr
bfd/versados.c:417 process_otr
bfd/versados.c:444 process_otr
  Failure to validate otr->esdid allows reading and writing into following data
members and up to 5719 bytes past the end of the versados_data_struct

bfd/versados.c:433 process_otr
  Null pointer dereference in pass 1

bfd/versados.c:397 process_otr
  Failure to validate dst_idx allows writing user-controlled 4-byte values to
memory locations at user-controlled offsets from the contents array.

-- 
You are receiving this mail because:
You are on the CC list for the bug.