PR24402, global buffer overflow in symtab_finalize

PR24402, global buffer overflow in symtab_finalize

[Alan Modra]

This bug goes back to git commit 5489fcc3d9d, Feb 1995.  Fixed by the
added dst[-1].name[0] check.

I also tweaked the initial prev_addr value since with an array of
symbols sorted by increasing addresses it seems like it may be
possible to wrongly match symbol addresses.  Not in real cases of
course, since a function calling _mcount must be more than one byte
long.

	PR 24402
	* symtab.c (symtab_finalize): Init prev_addr to one less than
	first symbol address, not one more.  Correct test for symbols
	with leading underscores.

diff --git a/gprof/symtab.c b/gprof/symtab.c
index 740168c703..70eb41573b 100644
--- a/gprof/symtab.c
+++ b/gprof/symtab.c
@@ -89,7 +89,7 @@ symtab_finalize (Sym_Table *tab)
 
   /* Remove duplicate entries to speed-up later processing and
      set end_addr if its not set yet.  */
-  prev_addr = tab->base[0].addr + 1;
+  prev_addr = tab->base[0].addr - 1;
 
   for (src = dst = tab->base; src < tab->limit; ++src)
     {
@@ -107,7 +107,7 @@ symtab_finalize (Sym_Table *tab)
 		  && ((src->is_func && !dst[-1].is_func)
 		      || ((src->is_func == dst[-1].is_func)
 			  && ((src->name[0] != '_' && dst[-1].name[0] == '_')
-			      || (src->name[0]
+			      || (src->name[0] == '_' && dst[-1].name[0] == '_'
 				  && src->name[1] != '_'
 				  && dst[-1].name[1] == '_'))))))
 	    {

-- 
Alan Modra
Australia Development Lab, IBM