FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

PR22306, Invalid free() in slurp_symtab()

Browse source 
PR 22306
	* aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
	and error for any other size that doesn't cover the header word.
This commit is contained in:
Alan Modra 2017-10-17 16:43:47 +10:30
parent e6e2dfbdc1
commit 0301ce1486
2 changed files with 38 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

6
bfd/ChangeLog
View file

@ -1,3 +1,9 @@
2017-10-17 Alan Modra <amodra@gmail.com>
PR 22306
* aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
and error for any other size that doesn't cover the header word.
2017-10-16 H.J. Lu <hongjiu.lu@intel.com> 2017-10-16 H.J. Lu <hongjiu.lu@intel.com>
* elf-bfd.h (elf_backend_data): Remove gc_sweep_hook. * elf-bfd.h (elf_backend_data): Remove gc_sweep_hook.

27
bfd/aoutx.h
View file

@ -1351,27 +1351,42 @@ aout_get_external_symbols (bfd *abfd)
|| bfd_bread ((void *) string_chars, amt, abfd) != amt) || bfd_bread ((void *) string_chars, amt, abfd) != amt)
return FALSE; return FALSE;
stringsize = GET_WORD (abfd, string_chars); stringsize = GET_WORD (abfd, string_chars);
if (stringsize == 0)
stringsize = 1;
else if (stringsize < BYTES_IN_WORD
|| (size_t) stringsize != stringsize)
{
bfd_set_error (bfd_error_bad_value);
return FALSE;
}
#ifdef USE_MMAP #ifdef USE_MMAP
if (stringsize >= BYTES_IN_WORD)
{
if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize, if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
&obj_aout_string_window (abfd), TRUE)) &obj_aout_string_window (abfd), TRUE))
return FALSE; return FALSE;
strings = (char *) obj_aout_string_window (abfd).data; strings = (char *) obj_aout_string_window (abfd).data;
#else }
strings = (char *) bfd_malloc (stringsize + 1); else
#endif
{
strings = (char *) bfd_malloc (stringsize);
if (strings == NULL) if (strings == NULL)
return FALSE; return FALSE;
/* Skip space for the string count in the buffer for convenience if (stringsize >= BYTES_IN_WORD)
when using indexes. */ {
/* Keep the string count in the buffer for convenience
when indexing with e_strx. */
amt = stringsize - BYTES_IN_WORD; amt = stringsize - BYTES_IN_WORD;
if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt) if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt)
{ {
free (strings); free (strings);
return FALSE; return FALSE;
} }
#endif }
}
/* Ensure that a zero index yields an empty string. */ /* Ensure that a zero index yields an empty string. */
strings[0] = '\0'; strings[0] = '\0';