From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) by sourceware.org (Postfix) with ESMTPS id 04CA33858D3C for ; Mon, 24 Apr 2023 11:32:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 04CA33858D3C Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pg1-x531.google.com with SMTP id 41be03b00d2f7-517bb01bac9so3135821a12.0 for ; Mon, 24 Apr 2023 04:32:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682335973; x=1684927973; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=v83lvNbKK2BpDI38haTrumeZWaDTI0qWmdBLvpdhjKM=; b=J9WJurY7f13wRg0PP5M6nUwTJc03VlmJW/fz3brhSvYFQGOpeGQRACy+djGNLeaEZD zVfMK1CfDHF+26HLCpg07QDSNn2wBjRFIsXnQuVBUH/xjScXB1GZojgbOTCRwCF2mSV2 62AMcvxd7Fq58cKya/nfmO9MChXmBbMHQD+0UlD9dkpJ0zGFqD6PY9QonYLcp7ANdG/b y2OQItGqbzD2gTG9Baw+l7N2gUbKeUWLb1BflM/L3vc1l8TE7Gj7J6nai+I3C6iKVENk EhJ0JM0qOQbAC88B1nlXk8j3LWEurySqe2Y/frm20aHPAPKimnMQaHmP2hWW5UPSNjBc MBxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682335973; x=1684927973; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=v83lvNbKK2BpDI38haTrumeZWaDTI0qWmdBLvpdhjKM=; b=lu+m5oKETiGlIHw4T4QaUaAOF4+7/yLIEbNMJI6Eajs1cWHVBc+4auE6pcz3ZEotfs +Fq3GOl4wMLxlDN8r+77NdvObqIDoRxNQTo7nS8KnHZlWV7nNrklK1z3kkDfO4q1040r 9Yb2tIbRSqHHO/dNaopulyrdkuoeGhZaXfIsKe3z5GdjH4K0aXUe4IikG29xOPh/8p0Z 8KTDHG3uD/weWLnsz4+UAeHjenN5sxccJqtJeJDBX3BguU9jrGd+u0feFJbkk7MjnNnH 1wweHjLTBnC0p4jZOkWQ8l240LH1Cq2QYi3zawNG/5f5BLq0gMePX+SIHb9GIl7NJ/DW yHBA== X-Gm-Message-State: AAQBX9cKfivFSl58gtOi+KOS2a8zrodiClSzA3apAqcE7JgfD8cv76M9 AiyX085/vw+hdwVG5adIQoG/Y28ofy4= X-Google-Smtp-Source: AKy350bTmvNeb8M+kMTF7sb6IbRI0zS6IXloNp1sJRVrGfK5kEeYBYOzS+v2HlWJqiFetzb6M3ER8w== X-Received: by 2002:a17:90a:cc04:b0:246:b898:5f54 with SMTP id b4-20020a17090acc0400b00246b8985f54mr13510074pju.16.1682335973460; Mon, 24 Apr 2023 04:32:53 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id o3-20020a17090a9f8300b0024b39ddfbdbsm6196583pjp.37.2023.04.24.04.32.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Apr 2023 04:32:52 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id C607A1142DD8; Mon, 24 Apr 2023 21:02:50 +0930 (ACST) Date: Mon, 24 Apr 2023 21:02:50 +0930 From: Alan Modra To: binutils@sourceware.org Subject: asan: segfault in coff_mangle_symbols Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3035.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: The testcase managed to trigger creation of a wild pointer in coff_slurp_symbol_table. Stop that happening, and fix an unrelated problem I happened to see in bfd_coff_get_syment. * coff-bfd.c (bfd_coff_get_syment): Clear fix_value after converting n_value from a pointer to an index. * coffcode.h (coff_slurp_symbol_table ): Sanity check symbol value before converting to a pointer. diff --git a/bfd/coff-bfd.c b/bfd/coff-bfd.c index 292778ecb56..9aceeb080a7 100644 --- a/bfd/coff-bfd.c +++ b/bfd/coff-bfd.c @@ -45,9 +45,12 @@ bfd_coff_get_syment (bfd *abfd, *psyment = csym->native->u.syment; if (csym->native->fix_value) - psyment->n_value = - ((psyment->n_value - (uintptr_t) obj_raw_syments (abfd)) - / sizeof (combined_entry_type)); + { + psyment->n_value = + ((psyment->n_value - (uintptr_t) obj_raw_syments (abfd)) + / sizeof (combined_entry_type)); + csym->native->fix_value = 0; + } /* FIXME: We should handle fix_line here. */ diff --git a/bfd/coffcode.h b/bfd/coffcode.h index 423f6c070ef..594f3e0457b 100644 --- a/bfd/coffcode.h +++ b/bfd/coffcode.h @@ -4852,13 +4852,18 @@ coff_slurp_symbol_table (bfd * abfd) case C_BSTAT: dst->symbol.flags = BSF_DEBUGGING; - /* The value is actually a symbol index. Save a pointer - to the symbol instead of the index. FIXME: This - should use a union. */ - src->u.syment.n_value - = (uintptr_t) (native_symbols + src->u.syment.n_value); - dst->symbol.value = src->u.syment.n_value; - src->fix_value = 1; + if (src->u.syment.n_value >= obj_raw_syment_count (abfd)) + dst->symbol.value = 0; + else + { + /* The value is actually a symbol index. Save a pointer + to the symbol instead of the index. FIXME: This + should use a union. */ + src->u.syment.n_value + = (uintptr_t) (native_symbols + src->u.syment.n_value); + dst->symbol.value = src->u.syment.n_value; + src->fix_value = 1; + } break; #endif -- Alan Modra Australia Development Lab, IBM