diff options
| author | Alan Modra <amodra@gmail.com> | 2021-10-24 20:27:06 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2021-10-24 22:05:51 +1030 |
| commit | 1ed0032b40063795d6c3ce89eab3101a8fd67569 (patch) | |
| tree | 8b934260c43ee41d117c8c9fb5e12062654b23ad /bfd/coffgen.c | |
| parent | e02812494254b70fec6fa432f7f668956711133b (diff) | |
| download | gdb-1ed0032b40063795d6c3ce89eab3101a8fd67569.zip gdb-1ed0032b40063795d6c3ce89eab3101a8fd67569.tar.gz gdb-1ed0032b40063795d6c3ce89eab3101a8fd67569.tar.bz2 | |
asan: c4x, c54x coff_canonicalize_reloc buffer overflow
Sometimes the investigation of a fuzzing bug report leads into areas
you'd rather not go. In this instance by the time I'd figured out the
real cause was a target variant that had never been properly supported
in binutils, the time needed to fix it was less than the time needed
to rip it out.
* coffcode.h (coff_set_alignment_hook): Call bfd_coff_swap_reloc_in
not coff_swap_reloc_in.
(coff_slurp_reloc_table): Likewise. Don't use RELOC type.
(ticoff0_swap_table): Use coff_swap_reloc_v0_out and
coff_swap_reloc_v0_in.
* coffswap.h (coff_swap_reloc_v0_in, coff_swap_reloc_v0_out): New.
* coff-tic54x.c (tic54x_lookup_howto): Don't abort.
* coffgen.c (coff_get_normalized_symtab): Use PTR_ADD.
* bfd-in.h (PTR_ADD, NPTR_ADD): Avoid warnings when passing an
expression.
* bfd-in2.h: Regenerate.
Diffstat (limited to 'bfd/coffgen.c')
| -rw-r--r-- | bfd/coffgen.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/bfd/coffgen.c b/bfd/coffgen.c index 77bda9e..6627a9a 100644 --- a/bfd/coffgen.c +++ b/bfd/coffgen.c @@ -1807,7 +1807,7 @@ coff_get_normalized_symtab (bfd *abfd) /* Mark the end of the symbols. */ symesz = bfd_coff_symesz (abfd); - raw_end = (char *) raw_src + obj_raw_syment_count (abfd) * symesz; + raw_end = PTR_ADD (raw_src, obj_raw_syment_count (abfd) * symesz); /* FIXME SOMEDAY. A string table size of zero is very weird, but probably possible. If one shows up, it will probably kill us. */ |