i386msdos uninitialised read

i386msdos uninitialised read

[Alan Modra]

Also reinstate ld i386aout for i386-msdos target, which doesn't build
otherwise.  Maybe the target should disappear?

bfd/
	* i386msdos.c (msdos_object_p): Don't access e_lfanew when that
	field hasn't been read.  Remove unnecessary casts.
ld/
	* Makefile.am (ALL_EMULATION_SOURCES): Reinstate ei386aout.c.
	Include ei386aout dep file.
	* Makefile.in: Regenerate.
	* po/BLD-POTFILES.in: Regenerate.

diff --git a/bfd/i386msdos.c b/bfd/i386msdos.c
index 5b56751cd3..e9307a7a42 100644
--- a/bfd/i386msdos.c
+++ b/bfd/i386msdos.c
@@ -47,10 +47,10 @@ msdos_object_p (bfd *abfd)
   struct external_DOS_hdr hdr;
   bfd_byte buffer[2];
   asection *section;
-  unsigned int size;
+  bfd_size_type size;
 
   if (bfd_seek (abfd, (file_ptr) 0, SEEK_SET) != 0
-      || bfd_bread (&hdr, (bfd_size_type) sizeof (hdr), abfd) < DOS_HDR_SIZE)
+      || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) < DOS_HDR_SIZE)
     {
       if (bfd_get_error () != bfd_error_system_call)
 	bfd_set_error (bfd_error_wrong_format);
@@ -67,9 +67,11 @@ msdos_object_p (bfd *abfd)
      e_lfanew field will be valid and point to a header beginning with one of
      the relevant signatures.  If not, e_lfanew might point to anything, so
      don't bail if we can't read there.  */
-  if (H_GET_16 (abfd, hdr.e_cparhdr) < 4
-      || bfd_seek (abfd, (file_ptr) H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
-      || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
+  if (size < offsetof (struct external_DOS_hdr, e_lfanew) + 4
+      || H_GET_16 (abfd, hdr.e_cparhdr) < 4)
+    ;
+  else if (bfd_seek (abfd, H_GET_32 (abfd, hdr.e_lfanew), SEEK_SET) != 0
+	   || bfd_bread (buffer, (bfd_size_type) 2, abfd) != 2)
     {
       if (bfd_get_error () == bfd_error_system_call)
 	return NULL;
@@ -102,7 +104,7 @@ msdos_object_p (bfd *abfd)
   size += H_GET_16 (abfd, hdr.e_cblp);
 
   /* Check that the size is valid.  */
-  if (bfd_seek (abfd, (file_ptr) (section->filepos + size), SEEK_SET) != 0)
+  if (bfd_seek (abfd, section->filepos + size, SEEK_SET) != 0)
     {
       if (bfd_get_error () != bfd_error_system_call)
 	bfd_set_error (bfd_error_wrong_format);
diff --git a/ld/Makefile.am b/ld/Makefile.am
index 4a9b8404b7..a64899fc09 100644
--- a/ld/Makefile.am
+++ b/ld/Makefile.am
@@ -312,6 +312,7 @@ ALL_EMULATION_SOURCES = \
 	ehppalinux.c \
 	ehppanbsd.c \
 	ehppaobsd.c \
+	ei386aout.c \
 	ei386beos.c \
 	ei386bsd.c \
 	ei386go32.c \
@@ -800,6 +801,7 @@ $(ALL_EMULATION_SOURCES) $(ALL_64_EMULATION_SOURCES): $(GEN_DEPENDS)
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppalinux.Pc@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppanbsd.Pc@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ehppaobsd.Pc@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386aout.Pc@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386beos.Pc@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386bsd.Pc@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ei386go32.Pc@am__quote@

-- 
Alan Modra
Australia Development Lab, IBM

Re: i386msdos uninitialised read

[Alan Modra]

Another fix.

	* i386msdos.c (msdos_object_p): Catch -1 return from bfd_bread.

diff --git a/bfd/i386msdos.c b/bfd/i386msdos.c
index e9307a7a42..38bb441034 100644
--- a/bfd/i386msdos.c
+++ b/bfd/i386msdos.c
@@ -50,7 +50,7 @@ msdos_object_p (bfd *abfd)
   bfd_size_type size;
 
   if (bfd_seek (abfd, (file_ptr) 0, SEEK_SET) != 0
-      || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) < DOS_HDR_SIZE)
+      || (size = bfd_bread (&hdr, sizeof (hdr), abfd)) + 1 < DOS_HDR_SIZE + 1)
     {
       if (bfd_get_error () != bfd_error_system_call)
 	bfd_set_error (bfd_error_wrong_format);

-- 
Alan Modra
Australia Development Lab, IBM