* [binutils-gdb] Prevent an illegal memory access when comparing the prefix of a section name regexp.
@ 2022-12-05 14:57 Nick Clifton
0 siblings, 0 replies; only message in thread
From: Nick Clifton @ 2022-12-05 14:57 UTC (permalink / raw)
To: bfd-cvs
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3bf5bf547a2ffdbd702804b95b3218040ac470dc
commit 3bf5bf547a2ffdbd702804b95b3218040ac470dc
Author: Nick Clifton <nickc@redhat.com>
Date: Mon Dec 5 14:57:17 2022 +0000
Prevent an illegal memory access when comparing the prefix of a section name regexp.
PR 29849
* ldlang.c (spec_match): Check that there is sufficient length in
the target name to match the spec's prefix.
Diff:
---
ld/ChangeLog | 6 ++++++
ld/ldlang.c | 26 +++++++++++++++++++++-----
2 files changed, 27 insertions(+), 5 deletions(-)
diff --git a/ld/ChangeLog b/ld/ChangeLog
index 8f0528ffb3c..e8dc0908cfa 100644
--- a/ld/ChangeLog
+++ b/ld/ChangeLog
@@ -1,3 +1,9 @@
+2022-12-05 Nick Clifton <nickc@redhat.com>
+
+ PR 29849
+ * ldlang.c (spec_match): Check that there is sufficient length in
+ the target name to match the spec's prefix.
+
2022-11-03 Nick Clifton <nickc@redhat.com>
PR 29748
diff --git a/ld/ldlang.c b/ld/ldlang.c
index d873adb8d9c..7829f86dfec 100644
--- a/ld/ldlang.c
+++ b/ld/ldlang.c
@@ -223,23 +223,39 @@ spec_match (const struct wildcard_spec *spec, const char *name)
size_t nl = spec->namelen;
size_t pl = spec->prefixlen;
size_t sl = spec->suffixlen;
+ size_t inputlen = strlen (name);
int r;
- if (pl && (r = memcmp (spec->name, name, pl)))
- return r;
+
+ if (pl)
+ {
+ if (inputlen < pl)
+ return 1;
+
+ r = memcmp (spec->name, name, pl);
+ if (r)
+ return r;
+ }
+
if (sl)
{
- size_t inputlen = strlen (name);
if (inputlen < sl)
return 1;
+
r = memcmp (spec->name + nl - sl, name + inputlen - sl, sl);
if (r)
return r;
}
+
if (nl == pl + sl + 1 && spec->name[pl] == '*')
return 0;
- else if (nl > pl)
+
+ if (nl > pl)
return fnmatch (spec->name + pl, name + pl, 0);
- return name[nl];
+
+ if (inputlen >= nl)
+ return name[nl];
+
+ return 0;
}
static char *
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-12-05 14:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-05 14:57 [binutils-gdb] Prevent an illegal memory access when comparing the prefix of a section name regexp Nick Clifton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).