diff options
| author | Nick Clifton <nickc@redhat.com> | 2016-12-05 16:34:45 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2016-12-05 16:34:45 +0000 |
| commit | fa6631b4eecfcca00c13b9594e6336dffd40982f (patch) | |
| tree | e836054631f57ce1951a51e1fbe290c9b8d81b57 | |
| parent | 406bd128dba2a59d0736839fc87a59bce319076c (diff) | |
| download | gdb-fa6631b4eecfcca00c13b9594e6336dffd40982f.zip gdb-fa6631b4eecfcca00c13b9594e6336dffd40982f.tar.gz gdb-fa6631b4eecfcca00c13b9594e6336dffd40982f.tar.bz2 | |
Fix seg-fault in the binutils utilities when reading a corrupt input file.
PR binutils/20905
* peicode.h (pe_ILF_object_p): Use strnlen to avoid running over
the end of the string buffer.
| -rw-r--r-- | bfd/ChangeLog | 4 | ||||
| -rw-r--r-- | bfd/peicode.h | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 8dc48b3..9a7bfcd 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -5,6 +5,10 @@ 2016-12-05 Nick Clifton <nickc@redhat.com> + PR binutils/20905 + * peicode.h (pe_ILF_object_p): Use strnlen to avoid running over + the end of the string buffer. + PR binutils/20907 * peicode.h (pe_ILF_build_a_bfd): Replace abort with error return. diff --git a/bfd/peicode.h b/bfd/peicode.h index ee47a67..5d55711 100644 --- a/bfd/peicode.h +++ b/bfd/peicode.h @@ -1269,7 +1269,8 @@ pe_ILF_object_p (bfd * abfd) } symbol_name = (char *) ptr; - source_dll = symbol_name + strlen (symbol_name) + 1; + /* See PR 20905 for an example of where the strnlen is necessary. */ + source_dll = symbol_name + strnlen (symbol_name, size - 1) + 1; /* Verify that the strings are null terminated. */ if (ptr[size - 1] != 0 |