Skip to content

Commit

Permalink
PE objdump -x
Browse files Browse the repository at this point in the history
objdump -x on PE executables produces lots of "xdata section corrupt"
and "corrupt unwind data" warnings, and refuses to dump that info.  It
turns out that the sanity checks were bad, not the data.  Fix them.

	* pei-x86_64.c (pex64_get_unwind_info): Correct buffer overrun
	sanity checks.
	(pex64_xdata_print_uwd_codes): Similarly.
  • Loading branch information
amodra committed Aug 2, 2022
1 parent d2dcf39 commit 217cbb0
Showing 1 changed file with 5 additions and 17 deletions.
22 changes: 5 additions & 17 deletions bfd/pei-x86_64.c
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,

memset (ui, 0, sizeof (struct pex64_unwind_info));

if (ex_dta >= ex_dta_end || ex_dta + 4 >= ex_dta_end)
if (ex_dta >= ex_dta_end || ex_dta + 4 > ex_dta_end)
return false;

ui->Version = PEX64_UWI_VERSION (ex_ui->Version_Flags);
Expand All @@ -124,13 +124,13 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,
ui->rawUnwindCodesEnd = ex_dta_end;

ex_dta += ui->SizeOfBlock;
if (ex_dta >= ex_dta_end)
if (ex_dta > ex_dta_end)
return false;

switch (ui->Flags)
{
case UNW_FLAG_CHAININFO:
if (ex_dta + 12 >= ex_dta_end)
if (ex_dta + 12 > ex_dta_end)
return false;
ui->rva_BeginAddress = bfd_get_32 (abfd, ex_dta + 0);
ui->rva_EndAddress = bfd_get_32 (abfd, ex_dta + 4);
Expand All @@ -140,7 +140,7 @@ pex64_get_unwind_info (bfd *abfd, struct pex64_unwind_info *ui,
case UNW_FLAG_EHANDLER:
case UNW_FLAG_UHANDLER:
case UNW_FLAG_FHANDLER:
if (ex_dta + 4 >= ex_dta_end)
if (ex_dta + 4 > ex_dta_end)
return false;
ui->rva_ExceptionHandler = bfd_get_32 (abfd, ex_dta);
ui->SizeOfBlock += 4;
Expand Down Expand Up @@ -172,7 +172,7 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,

i = 0;

if (ui->rawUnwindCodes + 1 >= ui->rawUnwindCodesEnd)
if (ui->rawUnwindCodes + ui->CountOfCodes * 2 > ui->rawUnwindCodesEnd)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
Expand All @@ -186,12 +186,6 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
to decode instruction flow if outside an epilog. */
unsigned int func_size = rf->rva_EndAddress - rf->rva_BeginAddress;

if (ui->rawUnwindCodes + 1 + (ui->CountOfCodes * 2) >= ui->rawUnwindCodesEnd)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
}

fprintf (file, "\tv2 epilog (length: %02x) at pc+:",
ui->rawUnwindCodes[0]);

Expand All @@ -215,12 +209,6 @@ pex64_xdata_print_uwd_codes (FILE *file, bfd *abfd,
fputc ('\n', file);
}

if (ui->rawUnwindCodes + 2 + (ui->CountOfCodes * 2) >= ui->rawUnwindCodesEnd)
{
fprintf (file, _("warning: corrupt unwind data\n"));
return;
}

for (; i < ui->CountOfCodes; i++)
{
const bfd_byte *dta = ui->rawUnwindCodes + 2 * i;
Expand Down

0 comments on commit 217cbb0

Please sign in to comment.