diff options
Diffstat (limited to 'bfd')
| -rw-r--r-- | bfd/ChangeLog | 9 | ||||
| -rw-r--r-- | bfd/dwarf2.c | 9 | ||||
| -rw-r--r-- | bfd/syms.c | 22 |
3 files changed, 33 insertions, 7 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 04c0c2a..fef5479 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,12 @@ +2018-09-20 Alan Modra <amodra@gmail.com> + + PR 23686 + * dwarf2.c (read_section): Error when attempting to malloc + "(bfd_size_type) -1". + * syms.c (_bfd_stab_section_find_nearest_line): Bounds check + function_name. Bounds check reloc address. Formatting. Ensure + .stabstr zero terminated. + 2018-09-18 Nick Clifton <nickc@redhat.com> PR 23657 diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c index 3b28855..77a7368 100644 --- a/bfd/dwarf2.c +++ b/bfd/dwarf2.c @@ -527,6 +527,7 @@ read_section (bfd * abfd, asection *msec; const char *section_name = sec->uncompressed_name; bfd_byte *contents = *section_buffer; + bfd_size_type amt; /* The section may have already been read. */ if (contents == NULL) @@ -549,7 +550,13 @@ read_section (bfd * abfd, *section_size = msec->rawsize ? msec->rawsize : msec->size; /* Paranoia - alloc one extra so that we can make sure a string section is NUL terminated. */ - contents = (bfd_byte *) bfd_malloc (*section_size + 1); + amt = *section_size + 1; + if (amt == 0) + { + bfd_set_error (bfd_error_no_memory); + return FALSE; + } + contents = (bfd_byte *) bfd_malloc (amt); if (contents == NULL) return FALSE; if (syms @@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, 0, strsize)) return FALSE; + /* Stab strings ought to be nul terminated. Ensure the last one + is, to prevent running off the end of the buffer. */ + info->strs[strsize - 1] = 0; + /* If this is a relocatable object file, we have to relocate the entries in .stab. This should always be simple 32 bit relocations against symbols defined in this object file, so @@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, || r->howto->bitsize != 32 || r->howto->pc_relative || r->howto->bitpos != 0 - || r->howto->dst_mask != 0xffffffff) + || r->howto->dst_mask != 0xffffffff + || r->address * bfd_octets_per_byte (abfd) + 4 > stabsize) { _bfd_error_handler (_("unsupported .stab relocation")); @@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, { nul_fun = stab; nul_str = str; - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize && *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO) @@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, directory_name = file_name; file_name = ((char *) str + bfd_get_32 (abfd, stab + STRDXOFF)); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; } } @@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); /* PR 17512: file: 0c680a1f. */ /* PR 17512: file: 5da8aec4. */ - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; break; @@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); if (function_name == (char *) str) continue; - if (function_name >= (char *) info->strs + strsize) + if (function_name >= (char *) info->strs + strsize + || function_name < (char *) str) function_name = NULL; nul_fun = NULL; @@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, if (val <= offset) { file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; *pline = 0; } |