mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-18 12:24:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

PR22306, Invalid free() in slurp_symtab()

Browse Source 
PR 22306
	* aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
	and error for any other size that doesn't cover the header word.
This commit is contained in:
Alan Modra 2017-10-17 16:43:47 +10:30
parent e6e2dfbdc1
commit 0301ce1486
2 changed files with 38 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2017-10-17 Alan Modra <amodra@gmail.com>
PR 22306
* aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
and error for any other size that doesn't cover the header word.
2017-10-16 H.J. Lu <hongjiu.lu@intel.com>
* elf-bfd.h (elf_backend_data): Remove gc_sweep_hook.

49
bfd/aoutx.h
View File

@ -1351,27 +1351,42 @@ aout_get_external_symbols (bfd *abfd)
|| bfd_bread ((void *) string_chars, amt, abfd) != amt)
return FALSE;
stringsize = GET_WORD (abfd, string_chars);
#ifdef USE_MMAP
if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
&obj_aout_string_window (abfd), TRUE))
return FALSE;
strings = (char *) obj_aout_string_window (abfd).data;
#else
strings = (char *) bfd_malloc (stringsize + 1);
if (strings == NULL)
return FALSE;
/* Skip space for the string count in the buffer for convenience
when using indexes. */
amt = stringsize - BYTES_IN_WORD;
if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt)
if (stringsize == 0)
stringsize = 1;
else if (stringsize < BYTES_IN_WORD
|| (size_t) stringsize != stringsize)
{
free (strings);
bfd_set_error (bfd_error_bad_value);
return FALSE;
}
#endif
#ifdef USE_MMAP
if (stringsize >= BYTES_IN_WORD)
{
if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
&obj_aout_string_window (abfd), TRUE))
return FALSE;
strings = (char *) obj_aout_string_window (abfd).data;
}
else
#endif
{
strings = (char *) bfd_malloc (stringsize);
if (strings == NULL)
return FALSE;
if (stringsize >= BYTES_IN_WORD)
{
/* Keep the string count in the buffer for convenience
when indexing with e_strx. */
amt = stringsize - BYTES_IN_WORD;
if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt)
{
free (strings);
return FALSE;
}
}
}
/* Ensure that a zero index yields an empty string. */
strings[0] = '\0';