Bug 1259 - windres does crash while converting res to coff
Summary: windres does crash while converting res to coff
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.17
: P2 normal
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-08-28 14:37 UTC by Hartmut Birr
Modified: 2006-03-29 14:35 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hartmut Birr 2005-08-28 14:37:10 UTC
Sometimes windres.exe does crash while converting a res to a coff file. It 
seems that is a bug in res_to_bin_accelerator (src/binutils/resbin.c, line 
1411). The allocated buffer is to small.

M:\Sandbox\binutils\src_work\binutils>cvs diff -u resbin.c
Index: resbin.c
===================================================================
RCS file: /cvs/src/src/binutils/resbin.c,v
retrieving revision 1.8
diff -u -r1.8 resbin.c
--- resbin.c    8 May 2005 14:17:39 -0000       1.8
+++ resbin.c    28 Aug 2005 14:12:05 -0000
@@ -1407,8 +1407,8 @@
       struct bindata *d;

       d = (struct bindata *) reswr_alloc (sizeof *d);
-      d->length = 8;
-      d->data = (unsigned char *) reswr_alloc (8);
+      d->length = 10;
+      d->data = (unsigned char *) reswr_alloc (10);

       put_16 (big_endian,
              a->flags | (a->next != NULL ? 0 : ACC_LAST),
Comment 1 Ben Elliston 2006-03-29 02:19:36 UTC
I don't think this patch is correct.  The allocated d->data is not overrun by
the code in res_to_bin_accelerator:

      put_16 (big_endian,
	      a->flags | (a->next != NULL ? 0 : ACC_LAST),
	      d->data);
      put_16 (big_endian, a->key, d->data + 2);
      put_16 (big_endian, a->id, d->data + 4);
      put_16 (big_endian, 0, d->data + 6);

Are you sure this is where your observed crash is occuring?  Can you please post
a backtrace?
Comment 2 Filip Navara 2006-03-29 14:35:04 UTC
It was fixed since, the last line was "put_16 (big_endian, 0, d->data + 8);" before.