Re: BFD overflows (part 2)

["H. J. Lu" <hjl@lucon.org>]

On Tue, May 17, 2005 at 07:08:11PM +0100, Nick Clifton wrote:
> Hi Mike,
> 
> >strings.095:
> >Program received signal SIGSEGV, Segmentation fault.
> >0x0000000000418678 in bfd_elf_string_from_elf_section (abfd=0x4643a0, 
> >    shindex=5784064, strindex=47) at elf.c:280
> 
> This was a nasty one - the file was stimulating an infinite loop inside 
> the code in elf.c between group_signature() and bfd_section_from_shdr(). 
>  Anyway I will be checking in the attached patch to catch and prevent 
> this occurring in the future.
> 

I prefer this patch.


H.J.
---
2005-05-17  H.J. Lu  <hongjiu.lu@intel.com>

	* elf.c (group_signature): Check if the symbol table section is
	correct.

--- bfd/elf.c.bad	2005-05-17 10:32:52.000000000 -0700
+++ bfd/elf.c	2005-05-17 14:27:10.000000000 -0700
@@ -452,8 +452,11 @@ group_signature (bfd *abfd, Elf_Internal
   Elf_External_Sym_Shndx eshndx;
   Elf_Internal_Sym isym;
 
-  /* First we need to ensure the symbol table is available.  */
-  if (! bfd_section_from_shdr (abfd, ghdr->sh_link))
+  /* First we need to ensure the symbol table is available.  Make sure
+     that it is a symbol table section.  */
+  hdr = elf_elfsections (abfd) [ghdr->sh_link];
+  if (hdr->sh_type != SHT_SYMTAB
+      || ! bfd_section_from_shdr (abfd, ghdr->sh_link))
     return NULL;
 
   /* Go read the symbol.  */