espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-27 22:48:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Re: readelf looping in process_archive

Browse Source 
This patch fixes a leak of qualified_name caused by 4c83662712 and a
double free introduced by fd486f32d1.  Not breaking out of the loop
results in an error: "failed to seek to next archive header".  That's
slightly better than silently preventing the possibility of endless
loops.

	* readelf.c (process_archive): Don't double free qualified_name.
	Don't break out of loop with "negative" archive_file_size, just
	set file offset to max.
This commit is contained in:
Alan Modra
2020-03-27 10:30:56 +10:30
parent 89ff19d45e
commit 80e2a3b66e
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
binutils/ChangeLog
View File

@ -1,3 +1,9 @@
2020-03-27 Alan Modra <amodra@gmail.com>
* readelf.c (process_archive): Don't double free qualified_name.
Don't break out of loop with "negative" archive_file_size, just
set file offset to max.
2020-03-25 Alan Modra <amodra@gmail.com>
* readelf.c (process_archive): Prevent endless loop.

3
binutils/readelf.c
View File

@ -20461,7 +20461,6 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
close_file (member_filedata);
free (member_file_name);
free (qualified_name);
}
else if (is_thin_archive)
{
@ -20511,7 +20510,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
arch.next_arhdr_offset += archive_file_size;
/* Stop looping with "negative" archive_file_size. */
if (arch.next_arhdr_offset < archive_file_size)
break;
arch.next_arhdr_offset = -1ul;
}
free (qualified_name);