From: Michael Matz <matz@sourceware.org>
To: bfd-cvs@sourceware.org
Subject: [binutils-gdb] ld: Avoid overflows in string merging
Date: Thu, 9 Nov 2023 16:44:51 +0000 (GMT) [thread overview]
Message-ID: <20231109164451.4EA163858D35@sourceware.org> (raw)
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=836654b1177ab305c36fe7319f08f0ad5d4fac1b
commit 836654b1177ab305c36fe7319f08f0ad5d4fac1b
Author: Michael Matz <matz@suse.de>
Date: Tue Nov 7 16:54:44 2023 +0100
ld: Avoid overflows in string merging
as the bug report shows we had an overflow in the test if
hash table resizing is needed. Reorder the expression to avoid
that. There's still a bug somewhere in gracefully handling
failure in resizing (e.g. out of memory), but this pushes the
boundary for that occurring somewhen into the future and
immediately helps the reporter.
bfd/
PR ld/31009
* merge.c (NEEDS_RESIZE): New macro avoiding overflow.
(sec_merge_maybe_resize): Use it.
(sec_merge_hash_insert): Ditto.
Diff:
---
bfd/merge.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/bfd/merge.c b/bfd/merge.c
index 722e6659486..61ffab4d706 100644
--- a/bfd/merge.c
+++ b/bfd/merge.c
@@ -94,6 +94,10 @@ struct sec_merge_hash
struct sec_merge_hash_entry **values;
};
+/* True when given NEWCOUNT and NBUCKETS indicate that the hash table needs
+ resizing. */
+#define NEEDS_RESIZE(newcount, nbuckets) ((newcount) > (nbuckets) / 3 * 2)
+
struct sec_merge_sec_info;
/* Information per merged blob. This is the unit of merging and is
@@ -167,7 +171,7 @@ static bool
sec_merge_maybe_resize (struct sec_merge_hash *table, unsigned added)
{
struct bfd_hash_table *bfdtab = &table->table;
- if (bfdtab->count + added > table->nbuckets * 2 / 3)
+ if (NEEDS_RESIZE (bfdtab->count + added, table->nbuckets))
{
unsigned i;
unsigned long newnb = table->nbuckets * 2;
@@ -175,7 +179,7 @@ sec_merge_maybe_resize (struct sec_merge_hash *table, unsigned added)
uint64_t *newl;
unsigned long alloc;
- while (bfdtab->count + added > newnb * 2 / 3)
+ while (NEEDS_RESIZE (bfdtab->count + added, newnb))
{
newnb *= 2;
if (!newnb)
@@ -239,8 +243,8 @@ sec_merge_hash_insert (struct sec_merge_hash *table,
hashp->alignment = 0;
hashp->u.suffix = NULL;
hashp->next = NULL;
- // We must not need resizing, otherwise _index is wrong
- BFD_ASSERT (bfdtab->count + 1 <= table->nbuckets * 2 / 3);
+ // We must not need resizing, otherwise the estimation was wrong
+ BFD_ASSERT (!NEEDS_RESIZE (bfdtab->count + 1, table->nbuckets));
bfdtab->count++;
table->key_lens[_index] = (hash << 32) | (uint32_t)len;
table->values[_index] = hashp;
reply other threads:[~2023-11-09 16:44 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231109164451.4EA163858D35@sourceware.org \
--to=matz@sourceware.org \
--cc=bfd-cvs@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).