1From 2cd3bb50e256f5ed5f611ac611d25fe673f2cec3 Mon Sep 17 00:00:00 2001
2From: Peter Johnson <johnson.peter@gmail.com>
3Date: Fri, 11 Aug 2023 10:49:51 +0000
4Subject: [PATCH] elf.c: Fix NULL deref on bad xsize expression (#234)
5
6CVE: CVE-2023-37732
7
8Upstream-Status: Backport [https://github.com/yasm/yasm/commit/2cd3bb50e256f5ed5f611ac611d25fe673f2cec3]
9
10Signed-off-by: Soumya <soumya.sambu@windriver.com>
11---
12 modules/objfmts/elf/elf.c | 10 +++++-----
13 1 file changed, 5 insertions(+), 5 deletions(-)
14
15diff --git a/modules/objfmts/elf/elf.c b/modules/objfmts/elf/elf.c
16index 2486bba8..bab4c9ca 100644
17--- a/modules/objfmts/elf/elf.c
18+++ b/modules/objfmts/elf/elf.c
19@@ -482,15 +482,15 @@ elf_symtab_write_to_file(FILE *f, elf_symtab_head *symtab,
20
21         /* get size (if specified); expr overrides stored integer */
22         if (entry->xsize) {
23-            size_intn = yasm_intnum_copy(
24-                yasm_expr_get_intnum(&entry->xsize, 1));
25-            if (!size_intn) {
26+            yasm_intnum *intn = yasm_expr_get_intnum(&entry->xsize, 1);
27+            if (!intn) {
28                 yasm_error_set(YASM_ERROR_VALUE,
29                                N_("size specifier not an integer expression"));
30                 yasm_errwarn_propagate(errwarns, entry->xsize->line);
31-            }
32+            } else
33+                size_intn = yasm_intnum_copy(intn);
34         }
35-        else
36+        if (!size_intn)
37             size_intn = yasm_intnum_create_uint(entry->size);
38
39         /* get EQU value for constants */
40--
412.40.0
42