aboutsummaryrefslogtreecommitdiff
path: root/binutils
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2007-06-18 16:02:45 +0000
committerNick Clifton <nickc@redhat.com>2007-06-18 16:02:45 +0000
commit03997556dae335abff76e00a41d1459e4bfa6ed1 (patch)
treeae00f396f4307ef7fd0472cd3f7b0027451d990b /binutils
parent31d99776c73d6fca13163da59c852b0fa99f89b8 (diff)
downloadgdb-03997556dae335abff76e00a41d1459e4bfa6ed1.zip
gdb-03997556dae335abff76e00a41d1459e4bfa6ed1.tar.gz
gdb-03997556dae335abff76e00a41d1459e4bfa6ed1.tar.bz2
* resres.c (probe_binary): Fix test for badly formatted headers.
Diffstat (limited to 'binutils')
-rw-r--r--binutils/ChangeLog4
-rw-r--r--binutils/resres.c17
2 files changed, 15 insertions, 6 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 1d9a542..f65bebb 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,7 @@
+2007-06-18 Thomas Weidenmueller <w3seek@reactos.org>
+
+ * resres.c (probe_binary): Fix test for badly formatted headers.
+
2007-06-18 Kai Tietz <Kai.Tietz@onevision.com>
* rclex.c: (cpp_line): Add code_page pragma support.
diff --git a/binutils/resres.c b/binutils/resres.c
index 8b75bcf..f345da3 100644
--- a/binutils/resres.c
+++ b/binutils/resres.c
@@ -554,10 +554,12 @@ read_unistring (windres_bfd *wrbfd, rc_uint_type *off, rc_uint_type omax,
rc_uint_type l;
rc_uint_type soff = off[0];
- do {
- read_res_data (wrbfd, &soff, omax, d, sizeof (unichar));
- c = windres_get_16 (wrbfd, d, 2);
- } while (c != 0);
+ do
+ {
+ read_res_data (wrbfd, &soff, omax, d, sizeof (unichar));
+ c = windres_get_16 (wrbfd, d, 2);
+ }
+ while (c != 0);
l = ((soff - off[0]) / sizeof (unichar));
/* there are hardly any names longer than 256 characters, but anyway. */
@@ -592,8 +594,11 @@ probe_binary (windres_bfd *wrbfd, rc_uint_type omax)
if ((off + BIN_RES_HDR_SIZE) >= omax)
return 1;
read_res_data_hdr (wrbfd, &off, omax, &reshdr);
- if ((off + reshdr.data_size + reshdr.header_size) > omax)
- return 0;
+ /* off is advanced by BIN_RES_HDR_SIZE in read_res_data_hdr()
+ which is part of reshdr.header_size. We shouldn't take it
+ into account twice. */
+ if ((off - BIN_RES_HDR_SIZE + reshdr.data_size + reshdr.header_size) > omax)
+ return 0;
return 1;
}