Blame SOURCES/binutils-CVE-2020-35448.patch

bf7c0a
diff -rup binutils.orig/bfd/elf.c binutils-2.35/bfd/elf.c
bf7c0a
--- binutils.orig/bfd/elf.c	2021-04-19 10:49:21.757290990 +0100
bf7c0a
+++ binutils-2.35/bfd/elf.c	2021-04-19 10:50:28.309839285 +0100
bf7c0a
@@ -12534,7 +12534,9 @@ _bfd_elf_slurp_secondary_reloc_section (
bf7c0a
       Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
bf7c0a
 
bf7c0a
       if (hdr->sh_type == SHT_SECONDARY_RELOC
bf7c0a
-	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
bf7c0a
+	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
bf7c0a
+	  && (hdr->sh_entsize == ebd->s->sizeof_rel
bf7c0a
+	      || hdr->sh_entsize == ebd->s->sizeof_rela))
bf7c0a
 	{
bf7c0a
 	  bfd_byte * native_relocs;
bf7c0a
 	  bfd_byte * native_reloc;
bf7c0a
diff -rup binutils.orig/bfd/elfcode.h binutils-2.35/bfd/elfcode.h
bf7c0a
--- binutils.orig/bfd/elfcode.h	2021-04-19 10:49:21.767290922 +0100
bf7c0a
+++ binutils-2.35/bfd/elfcode.h	2021-04-19 10:52:22.196066303 +0100
bf7c0a
@@ -568,7 +568,7 @@ elf_object_p (bfd *abfd)
bf7c0a
 
bf7c0a
   /* If this is a relocatable file and there is no section header
bf7c0a
      table, then we're hosed.  */
bf7c0a
-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
bf7c0a
+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
bf7c0a
     goto got_wrong_format_error;
bf7c0a
 
bf7c0a
   /* As a simple sanity check, verify that what BFD thinks is the
bf7c0a
@@ -578,7 +578,7 @@ elf_object_p (bfd *abfd)
bf7c0a
     goto got_wrong_format_error;
bf7c0a
 
bf7c0a
   /* Further sanity check.  */
bf7c0a
-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
bf7c0a
+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
bf7c0a
     goto got_wrong_format_error;
bf7c0a
 
bf7c0a
   ebd = get_elf_backend_data (abfd);
bf7c0a
@@ -615,7 +615,7 @@ elf_object_p (bfd *abfd)
bf7c0a
       && ebd->elf_osabi != ELFOSABI_NONE)
bf7c0a
     goto got_wrong_format_error;
bf7c0a
 
bf7c0a
-  if (i_ehdrp->e_shoff != 0)
bf7c0a
+  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
bf7c0a
     {
bf7c0a
       file_ptr where = (file_ptr) i_ehdrp->e_shoff;
bf7c0a
 
bf7c0a
@@ -807,7 +807,7 @@ elf_object_p (bfd *abfd)
bf7c0a
 	}
bf7c0a
     }
bf7c0a
 
bf7c0a
-  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
bf7c0a
+  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
bf7c0a
     {
bf7c0a
       unsigned int num_sec;
bf7c0a