Remove some static buffers

Fixes possible overflow of a static buffer for powerpc with translated messages, and on v850 when symbol names are large. * archive.c (_bfd_ar_spacepad, _bfd_ar_sizepad): Use auto buf. * coff-mcore.c (coff_mcore_relocate_section): Likewise. * elf32-ppc.c (ppc_elf_unhandled_reloc): Use asprintf in place of fixed size and possibly too small buf for translated message. * elf64-ppc.c (ppc64_elf_unhandled_reloc): Likewise. * elf32-v850.c (v850_elf_check_relocs): Likewise. * ecoff.c (ecoff_type_to_string): Pass in return string buff rather than using static buffer2. Delete dead code. Remove unnecessary parentheses. (_bfd_ecoff_print_symbol): Pass auto buff to ecoff_type_to_string. * elf32-rx.c (describe_flags): Pass in return string buf rather than using static buf. (rx_elf_merge_private_bfd_data): Pass buf to describe_flags. (rx_elf_print_private_bfd_data): Likewise. * mach-o.c (cpusubtype): Pass in return string buffer rather than using static buffer. (bfd_mach_o_bfd_print_private_bfd_data): Pass buff to cpusubtype. * opncls.c (separate_debug_file_exists): Make buffer an auto var. (bfd_fill_in_gnu_debuglink_section): Likewise. * peXXigen.c (rsrc_resource_name): Pass in return string buffer rather than using static buffer. (rsrc_sort_entries): Pass buff to rsrc_resource_name. * vms-alpha.c (_bfd_vms_write_emh): Pass tbuf to get_vms_time_string. * vms-misc.c (get_vms_time_string): Pass in return string tbuf rather than using static tbuf. * vms.h (get_vms_time_string): Update prototype.
2025-04-06 14:21:43 +08:00 · 2020-12-17 23:21:11 +10:30 · 2020-12-17 23:21:11 +10:30 · 7fbd5f4e2c
commit 7fbd5f4e2c
parent bd38246a45
14 changed files with 94 additions and 51 deletions
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@ -1,3 +1,32 @@
+2020-12-18  Alan Modra  <amodra@gmail.com>
+
+	* archive.c (_bfd_ar_spacepad, _bfd_ar_sizepad): Use auto buf.
+	* coff-mcore.c (coff_mcore_relocate_section): Likewise.
+	* elf32-ppc.c (ppc_elf_unhandled_reloc): Use asprintf in place
+	of fixed size and possibly too small buf for translated message.
+	* elf64-ppc.c (ppc64_elf_unhandled_reloc): Likewise.
+	* elf32-v850.c (v850_elf_check_relocs): Likewise.
+	* ecoff.c (ecoff_type_to_string): Pass in return string buff rather
+	than using static buffer2.  Delete dead code.  Remove unnecessary
+	parentheses.
+	(_bfd_ecoff_print_symbol): Pass auto buff to ecoff_type_to_string.
+	* elf32-rx.c (describe_flags): Pass in return string buf rather
+	than using static buf.
+	(rx_elf_merge_private_bfd_data): Pass buf to describe_flags.
+	(rx_elf_print_private_bfd_data): Likewise.
+	* mach-o.c (cpusubtype): Pass in return string buffer rather than
+	using static buffer.
+	(bfd_mach_o_bfd_print_private_bfd_data): Pass buff to cpusubtype.
+	* opncls.c (separate_debug_file_exists): Make buffer an auto var.
+	(bfd_fill_in_gnu_debuglink_section): Likewise.
+	* peXXigen.c (rsrc_resource_name): Pass in return string buffer
+	rather than using static buffer.
+	(rsrc_sort_entries): Pass buff to rsrc_resource_name.
+	* vms-alpha.c (_bfd_vms_write_emh): Pass tbuf to get_vms_time_string.
+	* vms-misc.c (get_vms_time_string): Pass in return string tbuf
+	rather than using static tbuf.
+	* vms.h (get_vms_time_string): Update prototype.
+
 2020-12-18  Alan Modra  <amodra@gmail.com>

 	* coff-z80.c (bfd_howto_type): Make typedef const.
--- a/bfd/archive.c
+++ b/bfd/archive.c
@ -172,7 +172,7 @@ struct ar_cache
 void
 _bfd_ar_spacepad (char *p, size_t n, const char *fmt, long val)
 {
-  static char buf[20];
+  char buf[20];
  size_t len;

  snprintf (buf, sizeof (buf), fmt, val);
@ -189,7 +189,7 @@ _bfd_ar_spacepad (char *p, size_t n, const char *fmt, long val)
 bfd_boolean
 _bfd_ar_sizepad (char *p, size_t n, bfd_size_type size)
 {
-  static char buf[21];
+  char buf[21];
  size_t len;

  snprintf (buf, sizeof (buf), "%-10" BFD_VMA_FMT "u", size);
--- a/bfd/coff-mcore.c
+++ b/bfd/coff-mcore.c
@ -392,6 +392,7 @@ coff_mcore_relocate_section (bfd * output_bfd,
      reloc_howto_type *	     howto = NULL;
      struct coff_link_hash_entry *  h;
      const char *		     my_name;
+      char buf[SYMNMLEN + 1];

      symndx = rel->r_symndx;
      loc = contents + rel->r_vaddr - input_section->vma;
@ -436,8 +437,6 @@ coff_mcore_relocate_section (bfd * output_bfd,
 		my_name = obj_coff_strings (input_bfd) + sym->_n._n_n._n_offset;
 	      else
 		{
-		  static char buf [SYMNMLEN + 1];
-
 		  strncpy (buf, sym->_n._n_name, SYMNMLEN);
 		  buf[SYMNMLEN] = '\0';
 		  my_name = buf;
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@ -1056,7 +1056,7 @@ ecoff_emit_aggregate (bfd *abfd,
 /* Convert the type information to string format.  */

 static char *
-ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
+ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx, char *buff)
 {
  union aux_ext *aux_ptr;
  int bigendian;
@ -1071,9 +1071,8 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
  unsigned int basic_type;
  int i;
  char buffer1[1024];
-  static char buffer2[1024];
  char *p1 = buffer1;
-  char *p2 = buffer2;
+  char *p2 = buff;
  RNDXR rndx;

  aux_ptr = ecoff_data (abfd)->debug_info.external_aux + fdr->iauxBase;
@ -1239,7 +1238,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
      break;
    }

-  p1 += strlen (buffer1);
+  p1 += strlen (p1);

  /* If this is a bitfield, get the bitsize.  */
  if (u.ti.fBitfield)
@ -1248,7 +1247,6 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)

      bitsize = AUX_GET_WIDTH (bigendian, &aux_ptr[indx++]);
      sprintf (p1, " : %d", bitsize);
-      p1 += strlen (buffer1);
    }

  /* Deal with any qualifiers.  */
@ -1332,7 +1330,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
 			       (long) (qualifiers[j].stride));

 		    else
-		      sprintf (p2, " {%ld bits}", (long) (qualifiers[j].stride));
+		      sprintf (p2, " {%ld bits}", (long) qualifiers[j].stride);

 		    p2 += strlen (p2);
 		    strcpy (p2, "] of ");
@ -1345,7 +1343,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
    }

  strcpy (p2, buffer1);
-  return buffer2;
+  return buff;
 }

 /* Return information about ECOFF symbol SYMBOL in RET.  */
@ -1514,13 +1512,16 @@ _bfd_ecoff_print_symbol (bfd *abfd,
 		if (ECOFF_IS_STAB (&ecoff_ext.asym))
 		  ;
 		else if (ecoffsymbol (symbol)->local)
-		  /* xgettext:c-format */
-		  fprintf (file, _("\n      End+1 symbol: %-7ld   Type:  %s"),
-			   ((long)
-			    (AUX_GET_ISYM (bigendian,
-					   &aux_base[ecoff_ext.asym.index])
-			     + sym_base)),
-			   ecoff_type_to_string (abfd, fdr, indx + 1));
+		  {
+		    char buff[1024];
+		    /* xgettext:c-format */
+		    fprintf (file, _("\n      End+1 symbol: %-7ld   Type:  %s"),
+			     ((long)
+			      (AUX_GET_ISYM (bigendian,
+					     &aux_base[ecoff_ext.asym.index])
+			       + sym_base)),
+			     ecoff_type_to_string (abfd, fdr, indx + 1, buff));
+		  }
 		else
 		  fprintf (file, _("\n      Local symbol: %ld"),
 			   ((long) indx
@ -1546,8 +1547,11 @@ _bfd_ecoff_print_symbol (bfd *abfd,

 	      default:
 		if (! ECOFF_IS_STAB (&ecoff_ext.asym))
-		  fprintf (file, _("\n      Type: %s"),
-			   ecoff_type_to_string (abfd, fdr, indx));
+		  {
+		    char buff[1024];
+		    fprintf (file, _("\n      Type: %s"),
+			     ecoff_type_to_string (abfd, fdr, indx, buff));
+		  }
 		break;
 	      }
 	  }
--- a/bfd/elf32-ppc.c
+++ b/bfd/elf32-ppc.c
@ -985,10 +985,12 @@ ppc_elf_unhandled_reloc (bfd *abfd,

  if (error_message != NULL)
    {
-      static char buf[60];
-      sprintf (buf, _("generic linker can't handle %s"),
-	       reloc_entry->howto->name);
-      *error_message = buf;
+      static char *message;
+      free (message);
+      if (asprintf (&message, _("generic linker can't handle %s"),
+		    reloc_entry->howto->name) < 0)
+	message = NULL;
+      *error_message = message;
    }
  return bfd_reloc_dangerous;
 }
--- a/bfd/elf32-rx.c
+++ b/bfd/elf32-rx.c
@ -3086,10 +3086,8 @@ bfd_elf32_rx_set_target_flags (bfd_boolean user_no_warn_mismatch,
   Returns a static pointer.  */

 static const char *
-describe_flags (flagword flags)
+describe_flags (flagword flags, char *buf)
 {
-  static char buf [128];
-
  buf[0] = 0;

  if (flags & E_FLAG_RX_64BIT_DOUBLES)
@ -3170,13 +3168,15 @@ rx_elf_merge_private_bfd_data (bfd * ibfd, struct bfd_link_info *info)
 	    }
 	  else
 	    {
+	      char buf[128];
+
 	      _bfd_error_handler (_("there is a conflict merging the"
 				    " ELF header flags from %pB"),
 				  ibfd);
 	      _bfd_error_handler (_("  the input  file's flags: %s"),
-				  describe_flags (new_flags));
+				  describe_flags (new_flags, buf));
 	      _bfd_error_handler (_("  the output file's flags: %s"),
-				  describe_flags (old_flags));
+				  describe_flags (old_flags, buf));
 	      error = TRUE;
 	    }
 	}
@ -3195,6 +3195,7 @@ rx_elf_print_private_bfd_data (bfd * abfd, void * ptr)
 {
  FILE * file = (FILE *) ptr;
  flagword flags;
+  char buf[128];

  BFD_ASSERT (abfd != NULL && ptr != NULL);

@ -3204,7 +3205,7 @@ rx_elf_print_private_bfd_data (bfd * abfd, void * ptr)
  flags = elf_elfheader (abfd)->e_flags;
  fprintf (file, _("private flags = 0x%lx:"), (long) flags);

-  fprintf (file, "%s", describe_flags (flags));
+  fprintf (file, "%s", describe_flags (flags, buf));
  return TRUE;
 }

--- a/bfd/elf32-v850.c
+++ b/bfd/elf32-v850.c
@ -144,7 +144,7 @@ v850_elf_check_relocs (bfd *abfd,
 		  && (h->other & V850_OTHER_ERROR) == 0)
 		{
 		  const char * msg;
-		  static char  buff[200]; /* XXX */
+		  char *buff;

 		  switch (h->other & V850_OTHER_MASK)
 		    {
@ -165,10 +165,14 @@ v850_elf_check_relocs (bfd *abfd,
 		      break;
 		    }

-		  sprintf (buff, msg, h->root.root.string);
-		  info->callbacks->warning (info, buff, h->root.root.string,
+		  if (asprintf (&buff, msg, h->root.root.string) < 0)
+		    buff = NULL;
+		  else
+		    msg = buff;
+		  info->callbacks->warning (info, msg, h->root.root.string,
 					    abfd, h->root.u.def.section,
 					    (bfd_vma) 0);
+		  free (buff);

 		  bfd_set_error (bfd_error_bad_value);
 		  h->other |= V850_OTHER_ERROR;
--- a/bfd/elf64-ppc.c
+++ b/bfd/elf64-ppc.c
@ -1715,10 +1715,12 @@ ppc64_elf_unhandled_reloc (bfd *abfd, arelent *reloc_entry, asymbol *symbol,

  if (error_message != NULL)
    {
-      static char buf[60];
-      sprintf (buf, "generic linker can't handle %s",
-	       reloc_entry->howto->name);
-      *error_message = buf;
+      static char *message;
+      free (message);
+      if (asprintf (&message, _("generic linker can't handle %s"),
+		    reloc_entry->howto->name) < 0)
+	message = NULL;
+      *error_message = message;
    }
  return bfd_reloc_dangerous;
 }
--- a/bfd/mach-o.c
+++ b/bfd/mach-o.c
@ -618,10 +618,8 @@ cputype (unsigned long value)
 }

 static const char *
-cpusubtype (unsigned long cpu_type, unsigned long cpu_subtype)
+cpusubtype (unsigned long cpu_type, unsigned long cpu_subtype, char *buffer)
 {
-  static char buffer[128];
-
  buffer[0] = 0;
  switch (cpu_subtype & BFD_MACH_O_CPU_SUBTYPE_MASK)
    {
@ -695,13 +693,14 @@ bfd_mach_o_bfd_print_private_bfd_data (bfd *abfd, void *ptr)
 {
  FILE * file = (FILE *) ptr;
  bfd_mach_o_data_struct *mdata = bfd_mach_o_get_data (abfd);
+  char buff[128];

  fprintf (file, _(" MACH-O header:\n"));
  fprintf (file, _("   magic:      %#lx\n"), (long) mdata->header.magic);
  fprintf (file, _("   cputype:    %#lx (%s)\n"), (long) mdata->header.cputype,
 	   cputype (mdata->header.cputype));
  fprintf (file, _("   cpusubtype: %#lx%s\n"), (long) mdata->header.cpusubtype,
-	   cpusubtype (mdata->header.cputype, mdata->header.cpusubtype));
+	   cpusubtype (mdata->header.cputype, mdata->header.cpusubtype, buff));
  fprintf (file, _("   filetype:   %#lx\n"), (long) mdata->header.filetype);
  fprintf (file, _("   ncmds:      %#lx\n"), (long) mdata->header.ncmds);
  fprintf (file, _("   sizeocmds:  %#lx\n"), (long) mdata->header.sizeofcmds);
--- a/bfd/opncls.c
+++ b/bfd/opncls.c
@ -1347,7 +1347,7 @@ DESCRIPTION
 static bfd_boolean
 separate_debug_file_exists (const char *name, void *crc32_p)
 {
-  static unsigned char buffer [8 * 1024];
+  unsigned char buffer[8 * 1024];
  unsigned long file_crc = 0;
  FILE *f;
  bfd_size_type count;
@ -1765,7 +1765,7 @@ bfd_fill_in_gnu_debuglink_section (bfd *abfd,
  char * contents;
  bfd_size_type crc_offset;
  FILE * handle;
-  static unsigned char buffer[8 * 1024];
+  unsigned char buffer[8 * 1024];
  size_t count;
  size_t filelen;

--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@ -3681,9 +3681,8 @@ rsrc_print_name (char * buffer, rsrc_string string)
 }

 static const char *
-rsrc_resource_name (rsrc_entry * entry, rsrc_directory * dir)
+rsrc_resource_name (rsrc_entry *entry, rsrc_directory *dir, char *buffer)
 {
-  static char buffer [256];
  bfd_boolean is_string = FALSE;

  buffer[0] = 0;
@ -4015,8 +4014,12 @@ rsrc_sort_entries (rsrc_dir_chain *  chain,
 			  || dir->entry->parent->entry == NULL)
 			_bfd_error_handler (_(".rsrc merge failure: duplicate leaf"));
 		      else
-			_bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"),
-					    rsrc_resource_name (entry, dir));
+			{
+			  char buff[256];
+
+			  _bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"),
+					      rsrc_resource_name (entry, dir, buff));
+			}
 		      bfd_set_error (bfd_error_file_truncated);
 		      return;
 		    }
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@ -2927,6 +2927,7 @@ static void
 _bfd_vms_write_emh (bfd *abfd)
 {
  struct vms_rec_wr *recwr = &PRIV (recwr);
+  unsigned char tbuf[18];

  _bfd_vms_output_alignment (recwr, 2);

@ -2949,7 +2950,7 @@ _bfd_vms_write_emh (bfd *abfd)
    _bfd_vms_output_counted (recwr, "NONAME");

  _bfd_vms_output_counted (recwr, BFD_VERSION_STRING);
-  _bfd_vms_output_dump (recwr, get_vms_time_string (), EMH_DATE_LENGTH);
+  _bfd_vms_output_dump (recwr, get_vms_time_string (tbuf), EMH_DATE_LENGTH);
  _bfd_vms_output_fill (recwr, 0, EMH_DATE_LENGTH);
  _bfd_vms_output_end (abfd, recwr);
 }
--- a/bfd/vms-misc.c
+++ b/bfd/vms-misc.c
@ -456,9 +456,8 @@ _bfd_vms_convert_to_var_unix_filename (const char *unix_filename)
   stolen from obj-vms.c.  */

 unsigned char *
-get_vms_time_string (void)
+get_vms_time_string (unsigned char *tbuf)
 {
-  static unsigned char tbuf[18];
 #ifndef VMS
  char *pnt;
  time_t timeb;
--- a/bfd/vms.h
+++ b/bfd/vms.h
@ -111,7 +111,7 @@ extern void _bfd_hexdump   (int, unsigned char *, int, int);
 #endif

 extern char * vms_get_module_name (const char *, bfd_boolean);
-extern unsigned char *get_vms_time_string (void);
+extern unsigned char *get_vms_time_string (unsigned char *);
 extern time_t vms_time_to_time_t (unsigned int hi, unsigned int lo);
 extern time_t vms_rawtime_to_time_t (unsigned char *);
 extern void vms_time_t_to_vms_time (time_t ut, unsigned int *hi, unsigned int *lo);