From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: PR29846, segmentation fault in objdump.c compare_symbols
Date: Mon, 5 Dec 2022 08:22:46 +1030 [thread overview]
Message-ID: <Y40WrrfotDOwKqZb@squeak.grove.modra.org> (raw)
Fixes a fuzzed object file problem where plt relocs were manipulated
in such a way that two synthetic symbols were generated at the same
plt location. Won't occur in real object files.
PR 29846
PR 20337
* objdump.c (compare_symbols): Test symbol flags to exclude
section and synthetic symbols before attempting to check flavour.
diff --git a/binutils/objdump.c b/binutils/objdump.c
index e8481b2d928..d95c8b68bf0 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -1222,20 +1222,17 @@ compare_symbols (const void *ap, const void *bp)
return 1;
}
- if (bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour
+ /* Sort larger size ELF symbols before smaller. See PR20337. */
+ bfd_vma asz = 0;
+ if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
+ && bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour)
+ asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
+ bfd_vma bsz = 0;
+ if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
&& bfd_get_flavour (bfd_asymbol_bfd (b)) == bfd_target_elf_flavour)
- {
- bfd_vma asz, bsz;
-
- asz = 0;
- if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
- asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
- bsz = 0;
- if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
- bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
- if (asz != bsz)
- return asz > bsz ? -1 : 1;
- }
+ bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
+ if (asz != bsz)
+ return asz > bsz ? -1 : 1;
/* Symbols that start with '.' might be section names, so sort them
after symbols that don't start with '.'. */
--
Alan Modra
Australia Development Lab, IBM
reply other threads:[~2022-12-04 21:52 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y40WrrfotDOwKqZb@squeak.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).