[PATCH] reloc.c, null ptr guard

[PATCH] reloc.c, null ptr guard

[msnyder]

[-- Attachment #1: Type: text/plain, Size: 91 bytes --]

If reloc_size is zero, we could reach this point with a null pointer,
and dereference it.


[-- Attachment #2: reloc2.txt --]
[-- Type: text/plain, Size: 876 bytes --]

2007-07-25  Michael Snyder  <msnyder@access-company.com>

	* reloc.c (bfd_generic_get_relocated_section_contents): Guard
	against null pointer reference.

Index: reloc.c
===================================================================
RCS file: /cvs/src/src/bfd/reloc.c,v
retrieving revision 1.168
diff -p -r1.168 reloc.c
*** reloc.c	3 Jul 2007 14:26:42 -0000	1.168
--- reloc.c	25 Jul 2007 22:11:50 -0000
*************** bfd_generic_get_relocated_section_conten
*** 5213,5219 ****
    if (reloc_count < 0)
      goto error_return;
  
!   if (reloc_count > 0)
      {
        arelent **parent;
        for (parent = reloc_vector; *parent != NULL; parent++)
--- 5213,5219 ----
    if (reloc_count < 0)
      goto error_return;
  
!   if (reloc_count > 0 && reloc_vector != NULL)
      {
        arelent **parent;
        for (parent = reloc_vector; *parent != NULL; parent++)

Re: [PATCH] reloc.c, null ptr guard

[Alan Modra]

On Wed, Jul 25, 2007 at 03:14:00PM -0700, msnyder@sonic.net wrote:
> If reloc_size is zero, we could reach this point with a null pointer,
> and dereference it.

No, because reloc_count will always be zero if reloc_size is zero.
This function could do with a cleanup though.

	* reloc.c (bfd_generic_get_relocated_section_contents): Avoid
	bfd_canonicalize_reloc call when bfd_get_reloc_upper_bound
	says there are no relocs.

Index: bfd/reloc.c
===================================================================
RCS file: /cvs/src/src/bfd/reloc.c,v
retrieving revision 1.168
diff -u -p -r1.168 reloc.c
--- bfd/reloc.c	3 Jul 2007 14:26:42 -0000	1.168
+++ bfd/reloc.c	26 Jul 2007 09:27:41 -0000
@@ -5185,26 +5185,28 @@ bfd_generic_get_relocated_section_conten
 					    bfd_boolean relocatable,
 					    asymbol **symbols)
 {
-  /* Get enough memory to hold the stuff.  */
   bfd *input_bfd = link_order->u.indirect.section->owner;
   asection *input_section = link_order->u.indirect.section;
-
-  long reloc_size = bfd_get_reloc_upper_bound (input_bfd, input_section);
-  arelent **reloc_vector = NULL;
+  long reloc_size;
+  arelent **reloc_vector;
   long reloc_count;
   bfd_size_type sz;
 
+  reloc_size = bfd_get_reloc_upper_bound (input_bfd, input_section);
   if (reloc_size < 0)
-    goto error_return;
-
-  reloc_vector = bfd_malloc (reloc_size);
-  if (reloc_vector == NULL && reloc_size != 0)
-    goto error_return;
+    return NULL;
 
   /* Read in the section.  */
   sz = input_section->rawsize ? input_section->rawsize : input_section->size;
   if (!bfd_get_section_contents (input_bfd, input_section, data, 0, sz))
-    goto error_return;
+    return NULL;
+
+  if (reloc_size == 0)
+    return data;
+
+  reloc_vector = bfd_malloc (reloc_size);
+  if (reloc_vector == NULL)
+    return NULL;
 
   reloc_count = bfd_canonicalize_reloc (input_bfd,
 					input_section,
@@ -5289,12 +5291,11 @@ bfd_generic_get_relocated_section_conten
 	    }
 	}
     }
-  if (reloc_vector != NULL)
-    free (reloc_vector);
+
+  free (reloc_vector);
   return data;
 
 error_return:
-  if (reloc_vector != NULL)
-    free (reloc_vector);
+  free (reloc_vector);
   return NULL;
 }

-- 
Alan Modra
Australia Development Lab, IBM