From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 115092 invoked by alias); 20 Sep 2018 07:59:32 -0000 Mailing-List: contact binutils-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: binutils-owner@sourceware.org Received: (qmail 114862 invoked by uid 89); 20 Sep 2018 07:59:31 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-25.6 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy=faults, Hx-spam-relays-external:209.85.215.196, H*RU:209.85.215.196, HX-HELO:sk:mail-pg X-HELO: mail-pg1-f196.google.com Received: from mail-pg1-f196.google.com (HELO mail-pg1-f196.google.com) (209.85.215.196) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 20 Sep 2018 07:59:29 +0000 Received: by mail-pg1-f196.google.com with SMTP id r1-v6so4028932pgp.11 for ; Thu, 20 Sep 2018 00:59:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:subject:message-id:mime-version:content-disposition :user-agent; bh=rHgnPkQlhCJIiEBXXtuOocM4kyOg0dkANAy38z6kyZs=; b=DbDQOeD22g19z7uipdcZGykPJZ5wt1pLr8aC75fmFOCxPSv0vUlV4yTQa6Y9CBhptX HrR3X8qZ9qo6TVuXm8EtOqaXIir0vdivZ+lfPUZWh8WpvDq+s/Mv2FKKmqO03Wy13zM/ 3+9Rm8vAffxsVLG0ePMqEXJxV7Vjh2YH0UXJ2fkDaBSvpPFK9AP4cHxqCR2zPCHzX/sZ UMVq+j4tDURjchPh1OWppvDyM83WO+z12YEXGq9nL5GcJ5u4fY7Hssrr3eoY8YOj62zp iCrO8tgefKV96eDHPXFvDJDm9oqlvNUg0jt/Kd0DaGsl8UbXJeUGb2Unze25vWPzmD5Z VkpQ== Return-Path: Received: from bubble.grove.modra.org ([58.175.241.133]) by smtp.gmail.com with ESMTPSA id e14-v6sm25760799pgv.48.2018.09.20.00.59.26 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 20 Sep 2018 00:59:26 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 0BD6980EC3; Thu, 20 Sep 2018 17:29:21 +0930 (ACST) Date: Thu, 20 Sep 2018 07:59:00 -0000 From: Alan Modra To: binutils@sourceware.org Subject: Bug 23686, two segment faults in nm Message-ID: <20180920075921.GI3174@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-IsSubscribed: yes X-SW-Source: 2018-09/txt/msg00287.txt.bz2 Fixes the bugs exposed by the testcases in the PR, plus two more bugs I noticed when looking at _bfd_stab_section_find_nearest_line. PR 23686 * dwarf2.c (read_section): Error when attempting to malloc "(bfd_size_type) -1". * syms.c (_bfd_stab_section_find_nearest_line): Bounds check function_name. Bounds check reloc address. Formatting. Ensure .stabstr zero terminated. diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c index 3b2885599e..77a7368dc0 100644 --- a/bfd/dwarf2.c +++ b/bfd/dwarf2.c @@ -527,6 +527,7 @@ read_section (bfd * abfd, asection *msec; const char *section_name = sec->uncompressed_name; bfd_byte *contents = *section_buffer; + bfd_size_type amt; /* The section may have already been read. */ if (contents == NULL) @@ -549,7 +550,13 @@ read_section (bfd * abfd, *section_size = msec->rawsize ? msec->rawsize : msec->size; /* Paranoia - alloc one extra so that we can make sure a string section is NUL terminated. */ - contents = (bfd_byte *) bfd_malloc (*section_size + 1); + amt = *section_size + 1; + if (amt == 0) + { + bfd_set_error (bfd_error_no_memory); + return FALSE; + } + contents = (bfd_byte *) bfd_malloc (amt); if (contents == NULL) return FALSE; if (syms diff --git a/bfd/syms.c b/bfd/syms.c index 187071fada..e09640ab74 100644 --- a/bfd/syms.c +++ b/bfd/syms.c @@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, 0, strsize)) return FALSE; + /* Stab strings ought to be nul terminated. Ensure the last one + is, to prevent running off the end of the buffer. */ + info->strs[strsize - 1] = 0; + /* If this is a relocatable object file, we have to relocate the entries in .stab. This should always be simple 32 bit relocations against symbols defined in this object file, so @@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, || r->howto->bitsize != 32 || r->howto->pc_relative || r->howto->bitpos != 0 - || r->howto->dst_mask != 0xffffffff) + || r->howto->dst_mask != 0xffffffff + || r->address * bfd_octets_per_byte (abfd) + 4 > stabsize) { _bfd_error_handler (_("unsupported .stab relocation")); @@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, { nul_fun = stab; nul_str = str; - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize && *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO) @@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, directory_name = file_name; file_name = ((char *) str + bfd_get_32 (abfd, stab + STRDXOFF)); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; } } @@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); /* PR 17512: file: 0c680a1f. */ /* PR 17512: file: 5da8aec4. */ - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; break; @@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); if (function_name == (char *) str) continue; - if (function_name >= (char *) info->strs + strsize) + if (function_name >= (char *) info->strs + strsize + || function_name < (char *) str) function_name = NULL; nul_fun = NULL; @@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd *abfd, if (val <= offset) { file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF); - if (file_name >= (char *) info->strs + strsize || file_name < (char *) str) + if (file_name >= (char *) info->strs + strsize + || file_name < (char *) str) file_name = NULL; *pline = 0; } -- Alan Modra Australia Development Lab, IBM