From: Koichi Arakawa <arakawa@pp.iij4u.or.jp>
To: 20264@debbugs.gnu.org
Subject: bug#20264: [PATCH] fix: w32_executable_type() causes a segmentation fault
Date: Mon, 06 Apr 2015 12:23:23 +0900 (=?UTF-8?Q?=E6=9D=B1=E4=BA=AC?= (=?UTF-8?Q?=E6=A8=99=E6=BA=96=E6=99=82?=)) [thread overview]
Message-ID: <20150406.122323.240448317693586769.arakawa@pp.iij4u.or.jp> (raw)
Hi folks,
On Windows platform, w32_executable_type() in src/w32proc.c scans
'dllname' in an EXE file. But there are some strange EXE files that
'dllname' points to an illegal address, for example, Microsoft's Excel
(excel.exe) and PowerPoint (POWEPNT.EXE). w32_executable_type() causes
a segmentation fault for those files.
objdump in binutils seems to know those illegal pointers and discard
them (pe_print_idata() in bfd/peXXigen.c).
In the following patch, 'dllname' is checked whether it points to the
valid section's address space and discarded when it's invalid.
Regards,
Koichi Arakawa
diff --git a/src/ChangeLog b/src/ChangeLog
index 1c3f933..a49fdf4 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2015-04-06 Koichi Arakawa <arakawa@pp.iij4u.or.jp>
+
+ * w32proc.c (w32_executable_type): Check whether 'dllname' points
+ to the section's address space.
+
2015-04-04 Jan Djärv <jan.h.d@swipnet.se>
* xselect.c (x_reply_selection_request)
diff --git a/src/w32proc.c b/src/w32proc.c
index 7d982f8..d3d9405 100644
--- a/src/w32proc.c
+++ b/src/w32proc.c
@@ -1618,16 +1618,23 @@ w32_executable_type (char * filename,
data_dir[IMAGE_DIRECTORY_ENTRY_IMPORT];
IMAGE_IMPORT_DESCRIPTOR * imports;
IMAGE_SECTION_HEADER * section;
+ char * base;
+ DWORD_PTR real_size;
section = rva_to_section (import_dir.VirtualAddress, nt_header);
imports = RVA_TO_PTR (import_dir.VirtualAddress, section,
executable);
+ base = RVA_TO_PTR (section->VirtualAddress, section, executable);
+ real_size = max (section->SizeOfRawData, section->Misc.VirtualSize);
for ( ; imports->Name; imports++)
{
char * dllname = RVA_TO_PTR (imports->Name, section,
executable);
+ if (imports->Name < base || dllname >= base + real_size)
+ break;
+
/* The exact name of the cygwin dll has changed with
various releases, but hopefully this will be reasonably
future proof. */
next reply other threads:[~2015-04-06 3:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-06 3:23 Koichi Arakawa [this message]
2015-04-06 8:02 ` bug#20264: [PATCH] fix: w32_executable_type() causes a segmentation fault Eli Zaretskii
2015-04-06 9:48 ` Koichi Arakawa
2015-04-06 10:30 ` Eli Zaretskii
2015-04-06 17:04 ` Koichi Arakawa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150406.122323.240448317693586769.arakawa@pp.iij4u.or.jp \
--to=arakawa@pp.iij4u.or.jp \
--cc=20264@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.