From f87a66db645caf8cc0e6fc87b0c28c78a38af59b Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Tue, 9 Sep 2025 18:32:09 +0930 Subject: [PATCH] PR 33406 SEGV in dump_dwarf_section Trying to dump .sframe in a PE file results in a segfault accessing elf_section_data. * objdump (dump_sframe_section, dump_dwarf_section): Don't access elf_section_type without first checking the file is ELF. --- binutils/objdump.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b] CVE: CVE-2025-11081 Signed-off-by: Alan Modra Signed-off-by: Yash Shinde diff --git a/binutils/objdump.c b/binutils/objdump.c index 290f7e51f66..ee8823da05a 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -4418,6 +4418,10 @@ else match = name; + if (bfd_get_flavour (abfd) == bfd_target_elf_flavour + && elf_section_type (section) == SHT_GNU_SFRAME) + match = ".sframe"; + for (i = 0; i < max; i++) if ((strcmp (debug_displays [i].section.uncompressed_name, match) == 0 || strcmp (debug_displays [i].section.compressed_name, match) == 0 @@ -4923,6 +4927,36 @@ } +static void +dump_sframe_section (bfd *abfd, const char *sect_name, bool is_mainfile) + +{ + /* Error checking for user provided SFrame section name, if any. */ + if (sect_name) + { + asection *sec = bfd_get_section_by_name (abfd, sect_name); + if (sec == NULL) + { + printf (_("No %s section present\n\n"), sanitize_string (sect_name)); + return; + } + /* Starting with Binutils 2.45, SFrame sections have section type + SHT_GNU_SFRAME. For SFrame sections from Binutils 2.44 or earlier, + check explcitly for SFrame sections of type SHT_PROGBITS and name + ".sframe" to allow them. */ + else if (bfd_get_flavour (abfd) != bfd_target_elf_flavour + || (elf_section_type (sec) != SHT_GNU_SFRAME + && !(elf_section_type (sec) == SHT_PROGBITS + && strcmp (sect_name, ".sframe") == 0))) + { + printf (_("Section %s does not contain SFrame data\n\n"), + sanitize_string (sect_name)); + return; + } + } + dump_dwarf (abfd, is_mainfile); +} + static void dump_target_specific (bfd *abfd) { const struct objdump_private_desc * const *desc; diff --git a/include/elf/common.h b/include/elf/common.h --- a/include/elf/common.h +++ b/include/elf/common.h @@ -528,6 +528,8 @@ #define SHT_LOOS 0x60000000 /* First of OS specific semantics */ #define SHT_HIOS 0x6fffffff /* Last of OS specific semantics */ +#define SHT_GNU_SFRAME 0x6ffffff4 /* SFrame stack trace information. */ + #define SHT_GNU_INCREMENTAL_INPUTS 0x6fff4700 /* incremental build data */ #define SHT_GNU_ATTRIBUTES 0x6ffffff5 /* Object attributes */ #define SHT_GNU_HASH 0x6ffffff6 /* GNU style symbol hash table */