mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-30 12:44:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

asan: segfault in coff_mangle_symbols

Browse Source 
The testcase managed to trigger creation of a wild pointer in
coff_slurp_symbol_table.  Stop that happening, and fix an unrelated
problem I happened to see in bfd_coff_get_syment.

	* coff-bfd.c (bfd_coff_get_syment): Clear fix_value after
	converting n_value from a pointer to an index.
	* coffcode.h (coff_slurp_symbol_table <C_BSTAT>): Sanity check
	symbol value before converting to a pointer.
This commit is contained in:
Alan Modra 2023-04-24 11:19:15 +09:30
parent c1eb3cd205
commit 2043ddb218
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
bfd/coff-bfd.c
View File

@ -45,9 +45,12 @@ bfd_coff_get_syment (bfd *abfd,
*psyment = csym->native->u.syment;
if (csym->native->fix_value)
psyment->n_value =
((psyment->n_value - (uintptr_t) obj_raw_syments (abfd))
/ sizeof (combined_entry_type));
{
psyment->n_value =
((psyment->n_value - (uintptr_t) obj_raw_syments (abfd))
/ sizeof (combined_entry_type));
csym->native->fix_value = 0;
}
/* FIXME: We should handle fix_line here. */

19
bfd/coffcode.h
View File

@ -4852,13 +4852,18 @@ coff_slurp_symbol_table (bfd * abfd)
case C_BSTAT:
dst->symbol.flags = BSF_DEBUGGING;
/* The value is actually a symbol index. Save a pointer
to the symbol instead of the index. FIXME: This
should use a union. */
src->u.syment.n_value
= (uintptr_t) (native_symbols + src->u.syment.n_value);
dst->symbol.value = src->u.syment.n_value;
src->fix_value = 1;
if (src->u.syment.n_value >= obj_raw_syment_count (abfd))
dst->symbol.value = 0;
else
{
/* The value is actually a symbol index. Save a pointer
to the symbol instead of the index. FIXME: This
should use a union. */
src->u.syment.n_value
= (uintptr_t) (native_symbols + src->u.syment.n_value);
dst->symbol.value = src->u.syment.n_value;
src->fix_value = 1;
}
break;
#endif