From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 31421 invoked by alias); 26 Jul 2007 00:06:31 -0000 Received: (qmail 31408 invoked by uid 22791); 26 Jul 2007 00:06:30 -0000 X-Spam-Check-By: sourceware.org Received: from b.mail.sonic.net (HELO b.mail.sonic.net) (64.142.19.5) by sourceware.org (qpsmtpd/0.31) with ESMTP; Thu, 26 Jul 2007 00:06:28 +0000 Received: from webmail.sonic.net (b.webmail.sonic.net [64.142.100.148]) by b.mail.sonic.net (8.13.8.Beta0-Sonic/8.13.7) with ESMTP id l6Q06QCS019502 for ; Wed, 25 Jul 2007 17:06:26 -0700 Received: from 12.7.175.2 (SquirrelMail authenticated user msnyder) by webmail.sonic.net with HTTP; Wed, 25 Jul 2007 17:06:26 -0700 (PDT) Message-ID: <13765.12.7.175.2.1185408386.squirrel@webmail.sonic.net> Date: Thu, 26 Jul 2007 00:21:00 -0000 Subject: [PATCH] srec_scan, check for EOF From: msnyder@sonic.net To: binutils@sourceware.org User-Agent: SquirrelMail/1.4.9a MIME-Version: 1.0 Content-Type: multipart/mixed;boundary="----=_20070725170626_58874" Mailing-List: contact binutils-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: binutils-owner@sourceware.org X-SW-Source: 2007-07/txt/msg00428.txt.bz2 ------=_20070725170626_58874 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Content-length: 88 If we miss an EOF here, it'll be used as an array index and probably cause a segfault. ------=_20070725170626_58874 Content-Type: text/plain; name="eof.txt" Content-Transfer-Encoding: 8bit Content-Disposition: attachment; filename="eof.txt" Content-length: 814 2007-07-25 Michael Snyder * srec.c (srec_scan): Check for EOF (critical because return value will be used as array index). Index: srec.c =================================================================== RCS file: /cvs/src/src/bfd/srec.c,v retrieving revision 1.42 diff -p -5 -r1.42 srec.c *** srec.c 3 Jul 2007 14:26:42 -0000 1.42 --- srec.c 26 Jul 2007 00:03:57 -0000 *************** srec_scan (bfd *abfd) *** 426,435 **** --- 426,440 ---- while (ISHEX (c)) { symval <<= 4; symval += NIBBLE (c); c = srec_get_byte (abfd, &error); + if (c == EOF) + { + srec_bad_byte (abfd, lineno, c, error); + goto error_return; + } } if (! srec_new_symbol (abfd, symname, symval)) goto error_return; } ------=_20070725170626_58874--