FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bug 23686, two segment faults in nm

Browse source 
Fixes the bugs exposed by the testcases in the PR, plus two more bugs
I noticed when looking at _bfd_stab_section_find_nearest_line.

	PR 23686
	* dwarf2.c (read_section): Error when attempting to malloc
	"(bfd_size_type) -1".
	* syms.c (_bfd_stab_section_find_nearest_line): Bounds check
	function_name.  Bounds check reloc address.  Formatting.  Ensure
	.stabstr zero terminated.
This commit is contained in:
Alan Modra 2018-09-20 15:29:17 +09:30
parent 4ee9b0c53a
commit 3083813299
3 changed files with 33 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
bfd/ChangeLog
View file

@ -1,3 +1,12 @@
2018-09-20 Alan Modra <amodra@gmail.com>
PR 23686
* dwarf2.c (read_section): Error when attempting to malloc
"(bfd_size_type) -1".
* syms.c (_bfd_stab_section_find_nearest_line): Bounds check
function_name. Bounds check reloc address. Formatting. Ensure
.stabstr zero terminated.
2018-09-18 Nick Clifton <nickc@redhat.com>
PR 23657

9
bfd/dwarf2.c
View file

@ -527,6 +527,7 @@ read_section (bfd * abfd,
asection *msec;
const char *section_name = sec->uncompressed_name;
bfd_byte *contents = *section_buffer;
bfd_size_type amt;
/* The section may have already been read. */
if (contents == NULL)
@ -549,7 +550,13 @@ read_section (bfd * abfd,
*section_size = msec->rawsize ? msec->rawsize : msec->size;
/* Paranoia - alloc one extra so that we can make sure a string
section is NUL terminated. */
contents = (bfd_byte *) bfd_malloc (*section_size + 1);
amt = *section_size + 1;
if (amt == 0)
{
bfd_set_error (bfd_error_no_memory);
return FALSE;
}
contents = (bfd_byte *) bfd_malloc (amt);
if (contents == NULL)
return FALSE;
if (syms

22
bfd/syms.c
View file

@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
0, strsize))
return FALSE;
/* Stab strings ought to be nul terminated. Ensure the last one
is, to prevent running off the end of the buffer. */
info->strs[strsize - 1] = 0;
/* If this is a relocatable object file, we have to relocate
the entries in .stab. This should always be simple 32 bit
relocations against symbols defined in this object file, so
@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
|| r->howto->bitsize != 32
|| r->howto->pc_relative
|| r->howto->bitpos != 0
|| r->howto->dst_mask != 0xffffffff)
|| r->howto->dst_mask != 0xffffffff
|| r->address * bfd_octets_per_byte (abfd) + 4 > stabsize)
{
_bfd_error_handler
(_("unsupported .stab relocation"));
@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
{
nul_fun = stab;
nul_str = str;
if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
if (file_name >= (char *) info->strs + strsize
|| file_name < (char *) str)
file_name = NULL;
if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize
&& *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO)
@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
directory_name = file_name;
file_name = ((char *) str
+ bfd_get_32 (abfd, stab + STRDXOFF));
if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
if (file_name >= (char *) info->strs + strsize
|| file_name < (char *) str)
file_name = NULL;
}
}
@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
/* PR 17512: file: 0c680a1f. */
/* PR 17512: file: 5da8aec4. */
if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
if (file_name >= (char *) info->strs + strsize
|| file_name < (char *) str)
file_name = NULL;
break;
@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
if (function_name == (char *) str)
continue;
if (function_name >= (char *) info->strs + strsize)
if (function_name >= (char *) info->strs + strsize
|| function_name < (char *) str)
function_name = NULL;
nul_fun = NULL;
@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd,
if (val <= offset)
{
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
if (file_name >= (char *) info->strs + strsize
|| file_name < (char *) str)
file_name = NULL;
*pline = 0;
}