espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-26 22:07:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

som: Don't loop forever reading symbol chains

Browse Source 
* som.c (som_bfd_count_ar_symbols): Error when file position
	of symbols on chains is not strictly increasing.
This commit is contained in:
Alan Modra
2020-01-14 10:45:41 +10:30
parent 8ab484c23b
commit ef4e5ba50c
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
bfd/ChangeLog
View File

@ -1,3 +1,8 @@
2020-01-14 Alan Modra <amodra@gmail.com>
* som.c (som_bfd_count_ar_symbols): Error when file position
of symbols on chains is not strictly increasing.
2020-01-14 Alan Modra <amodra@gmail.com> 2020-01-14 Alan Modra <amodra@gmail.com>
* vms.h (VMS_DEBUG): Define as 0. * vms.h (VMS_DEBUG): Define as 0.

13
bfd/som.c
View File

@ -5892,8 +5892,8 @@ som_bfd_count_ar_symbols (bfd *abfd,
/* Don't forget to initialize the counter! */ /* Don't forget to initialize the counter! */
*count = 0; *count = 0;
/* Read in the hash table. The has table is an array of 32bit file offsets /* Read in the hash table. The hash table is an array of 32-bit
which point to the hash chains. */ file offsets which point to the hash chains. */
amt = (bfd_size_type) lst_header->hash_size * 4; amt = (bfd_size_type) lst_header->hash_size * 4;
if (bfd_bread ((void *) hash_table, amt, abfd) != amt) if (bfd_bread ((void *) hash_table, amt, abfd) != amt)
goto error_return; goto error_return;
@ -5928,6 +5928,15 @@ som_bfd_count_ar_symbols (bfd *abfd,
if (next_entry == 0) if (next_entry == 0)
break; break;
/* Assume symbols on a chain are in increasing file offset
order. Otherwise we can loop here with fuzzed input. */
if (next_entry < hash_val + sizeof (ext_lst_symbol))
{
bfd_set_error (bfd_error_bad_value);
goto error_return;
}
hash_val = next_entry;
/* Seek to the next symbol. */ /* Seek to the next symbol. */
if (bfd_seek (abfd, lst_filepos + next_entry, SEEK_SET) != 0) if (bfd_seek (abfd, lst_filepos + next_entry, SEEK_SET) != 0)
goto error_return; goto error_return;