|
 |
13ae24 |
diff -rup binutils.orig/bfd/dwarf2.c binutils-2.30/bfd/dwarf2.c
|
|
|
13ae24 |
--- binutils.orig/bfd/dwarf2.c 2018-09-26 15:07:47.162863937 +0100
|
|
|
13ae24 |
+++ binutils-2.30/bfd/dwarf2.c 2018-09-26 15:08:50.868368183 +0100
|
|
|
13ae24 |
@@ -527,6 +527,7 @@ read_section (bfd * abfd,
|
|
|
13ae24 |
asection *msec;
|
|
|
13ae24 |
const char *section_name = sec->uncompressed_name;
|
|
|
13ae24 |
bfd_byte *contents = *section_buffer;
|
|
|
13ae24 |
+ bfd_size_type amt;
|
|
|
13ae24 |
|
|
|
13ae24 |
/* The section may have already been read. */
|
|
|
13ae24 |
if (contents == NULL)
|
|
|
13ae24 |
@@ -549,7 +550,14 @@ read_section (bfd * abfd,
|
|
|
13ae24 |
*section_size = msec->rawsize ? msec->rawsize : msec->size;
|
|
|
13ae24 |
/* Paranoia - alloc one extra so that we can make sure a string
|
|
|
13ae24 |
section is NUL terminated. */
|
|
|
13ae24 |
- contents = (bfd_byte *) bfd_malloc (*section_size + 1);
|
|
|
13ae24 |
+ amt = *section_size + 1;
|
|
|
13ae24 |
+ if (amt == 0)
|
|
|
13ae24 |
+ {
|
|
|
13ae24 |
+ bfd_set_error (bfd_error_no_memory);
|
|
|
13ae24 |
+ return FALSE;
|
|
|
13ae24 |
+ }
|
|
|
13ae24 |
+ contents = (bfd_byte *) bfd_malloc (amt);
|
|
|
13ae24 |
+
|
|
|
13ae24 |
if (contents == NULL)
|
|
|
13ae24 |
return FALSE;
|
|
|
13ae24 |
if (syms
|
|
|
13ae24 |
diff -rup binutils.orig/bfd/syms.c binutils-2.30/bfd/syms.c
|
|
|
13ae24 |
--- binutils.orig/bfd/syms.c 2018-09-26 15:07:47.162863937 +0100
|
|
|
13ae24 |
+++ binutils-2.30/bfd/syms.c 2018-09-26 15:11:41.671038993 +0100
|
|
|
13ae24 |
@@ -1035,6 +1035,10 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
0, strsize))
|
|
|
13ae24 |
return FALSE;
|
|
|
13ae24 |
|
|
|
13ae24 |
+ /* Stab strings ought to be nul terminated. Ensure the last one
|
|
|
13ae24 |
+ is, to prevent running off the end of the buffer. */
|
|
|
13ae24 |
+ info->strs[strsize - 1] = 0;
|
|
|
13ae24 |
+
|
|
|
13ae24 |
/* If this is a relocatable object file, we have to relocate
|
|
|
13ae24 |
the entries in .stab. This should always be simple 32 bit
|
|
|
13ae24 |
relocations against symbols defined in this object file, so
|
|
|
13ae24 |
@@ -1073,7 +1077,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
|| r->howto->bitsize != 32
|
|
|
13ae24 |
|| r->howto->pc_relative
|
|
|
13ae24 |
|| r->howto->bitpos != 0
|
|
|
13ae24 |
- || r->howto->dst_mask != 0xffffffff)
|
|
|
13ae24 |
+ || r->howto->dst_mask != 0xffffffff
|
|
|
13ae24 |
+ || r->address * bfd_octets_per_byte (abfd) + 4 > stabsize)
|
|
|
13ae24 |
{
|
|
|
13ae24 |
_bfd_error_handler
|
|
|
13ae24 |
(_("Unsupported .stab relocation"));
|
|
|
13ae24 |
@@ -1195,7 +1200,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
{
|
|
|
13ae24 |
nul_fun = stab;
|
|
|
13ae24 |
nul_str = str;
|
|
|
13ae24 |
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
|
|
|
13ae24 |
+ if (file_name >= (char *) info->strs + strsize
|
|
|
13ae24 |
+ || file_name < (char *) str)
|
|
|
13ae24 |
file_name = NULL;
|
|
|
13ae24 |
if (stab + STABSIZE + TYPEOFF < info->stabs + stabsize
|
|
|
13ae24 |
&& *(stab + STABSIZE + TYPEOFF) == (bfd_byte) N_SO)
|
|
|
13ae24 |
@@ -1206,7 +1212,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
directory_name = file_name;
|
|
|
13ae24 |
file_name = ((char *) str
|
|
|
13ae24 |
+ bfd_get_32 (abfd, stab + STRDXOFF));
|
|
|
13ae24 |
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
|
|
|
13ae24 |
+ if (file_name >= (char *) info->strs + strsize
|
|
|
13ae24 |
+ || file_name < (char *) str)
|
|
|
13ae24 |
file_name = NULL;
|
|
|
13ae24 |
}
|
|
|
13ae24 |
}
|
|
|
13ae24 |
@@ -1217,7 +1224,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
|
|
|
13ae24 |
/* PR 17512: file: 0c680a1f. */
|
|
|
13ae24 |
/* PR 17512: file: 5da8aec4. */
|
|
|
13ae24 |
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
|
|
|
13ae24 |
+ if (file_name >= (char *) info->strs + strsize
|
|
|
13ae24 |
+ || file_name < (char *) str)
|
|
|
13ae24 |
file_name = NULL;
|
|
|
13ae24 |
break;
|
|
|
13ae24 |
|
|
|
13ae24 |
@@ -1226,7 +1234,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
function_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
|
|
|
13ae24 |
if (function_name == (char *) str)
|
|
|
13ae24 |
continue;
|
|
|
13ae24 |
- if (function_name >= (char *) info->strs + strsize)
|
|
|
13ae24 |
+ if (function_name >= (char *) info->strs + strsize
|
|
|
13ae24 |
+ || function_name < (char *) str)
|
|
|
13ae24 |
function_name = NULL;
|
|
|
13ae24 |
|
|
|
13ae24 |
nul_fun = NULL;
|
|
|
13ae24 |
@@ -1335,7 +1344,8 @@ _bfd_stab_section_find_nearest_line (bfd
|
|
|
13ae24 |
if (val <= offset)
|
|
|
13ae24 |
{
|
|
|
13ae24 |
file_name = (char *) str + bfd_get_32 (abfd, stab + STRDXOFF);
|
|
|
13ae24 |
- if (file_name >= (char *) info->strs + strsize || file_name < (char *) str)
|
|
|
13ae24 |
+ if (file_name >= (char *) info->strs + strsize
|
|
|
13ae24 |
+ || file_name < (char *) str)
|
|
|
13ae24 |
file_name = NULL;
|
|
|
13ae24 |
*pline = 0;
|
|
|
13ae24 |
}
|