This is the mail archive of the
binutils@sources.redhat.com
mailing list for the binutils project.
[PATCH] bfd robustification (avoid crashes on bogus ar archives)
- From: Jakub Jelinek <jakub at redhat dot com>
- To: binutils at sources dot redhat dot com
- Date: Tue, 21 Jun 2005 19:20:02 +0200
- Subject: [PATCH] bfd robustification (avoid crashes on bogus ar archives)
- Reply-to: Jakub Jelinek <jakub at redhat dot com>
Hi!
Following patch robustifies extended names archive handling.
Ok to commit?
2005-06-21 Jakub Jelinek <jakub@redhat.com>
* libbfd-in.h (struct artdata): Add extended_names_size field.
* libbfd.h: Rebuilt.
* coff-rs600.c (_bfd_xcoff_archive_p): Don't clear fields in freshly
allocated object by bfd_zalloc.
* coff64-rs6000.c (xcoff64_archive_p): Likewise.
* ecoff.c (_bfd_ecoff_archive_p): Likewise.
* archive.c (_bfd_generic_mkarchive, bfd_generic_archive_p): Likewise.
(get_extended_arelt_filename): Fail if index is bigger or equal to
extended_names_size.
(_bfd_generic_read_ar_hdr_mag): Don't set bfd_error_malformed_archive,
get_extended_arelt_filename already did that.
(_bfd_slurp_extended_name_table): Initialize extended_names_size field.
Allocate one extra byte and clear it, in case extended names table
is not terminated.
--- bfd/libbfd-in.h.jj 2005-06-20 12:16:18.000000000 +0200
+++ bfd/libbfd-in.h 2005-06-21 18:45:56.000000000 +0200
@@ -64,6 +64,7 @@ struct artdata {
carsym *symdefs; /* the symdef entries */
symindex symdef_count; /* how many there are */
char *extended_names; /* clever intel extension */
+ bfd_size_type extended_names_size; /* Size of extended names */
/* when more compilers are standard C, this can be a time_t */
long armap_timestamp; /* Timestamp value written into armap.
This is used for BSD archives to check
--- bfd/libbfd.h.jj 2005-06-20 12:16:18.000000000 +0200
+++ bfd/libbfd.h 2005-06-21 18:46:32.000000000 +0200
@@ -69,6 +69,7 @@ struct artdata {
carsym *symdefs; /* the symdef entries */
symindex symdef_count; /* how many there are */
char *extended_names; /* clever intel extension */
+ bfd_size_type extended_names_size; /* Size of extended names */
/* when more compilers are standard C, this can be a time_t */
long armap_timestamp; /* Timestamp value written into armap.
This is used for BSD archives to check
--- bfd/coff64-rs6000.c.jj 2005-06-09 10:58:49.000000000 +0200
+++ bfd/coff64-rs6000.c 2005-06-21 18:59:07.000000000 +0200
@@ -1983,10 +1983,12 @@ xcoff64_archive_p (abfd)
if (bfd_ardata (abfd) == (struct artdata *) NULL)
goto error_ret_restore;
- bfd_ardata (abfd)->cache = NULL;
- bfd_ardata (abfd)->archive_head = NULL;
- bfd_ardata (abfd)->symdefs = NULL;
- bfd_ardata (abfd)->extended_names = NULL;
+ /* Already cleared by bfd_zalloc above.
+ bfd_ardata (abfd)->cache = NULL;
+ bfd_ardata (abfd)->archive_head = NULL;
+ bfd_ardata (abfd)->symdefs = NULL;
+ bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0; */
bfd_ardata (abfd)->first_file_filepos = bfd_scan_vma (hdr.firstmemoff,
(const char **) NULL,
10);
--- bfd/coff-rs6000.c.jj 2005-06-09 10:58:49.000000000 +0200
+++ bfd/coff-rs6000.c 2005-06-21 18:56:11.000000000 +0200
@@ -1294,10 +1294,12 @@ _bfd_xcoff_archive_p (abfd)
if (bfd_ardata (abfd) == (struct artdata *) NULL)
goto error_ret_restore;
- bfd_ardata (abfd)->cache = NULL;
- bfd_ardata (abfd)->archive_head = NULL;
- bfd_ardata (abfd)->symdefs = NULL;
- bfd_ardata (abfd)->extended_names = NULL;
+ /* Cleared by bfd_zalloc above.
+ bfd_ardata (abfd)->cache = NULL;
+ bfd_ardata (abfd)->archive_head = NULL;
+ bfd_ardata (abfd)->symdefs = NULL;
+ bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0; */
/* Now handle the two formats. */
if (magic[1] != 'b')
--- bfd/ecoff.c.jj 2005-05-13 23:44:07.000000000 +0200
+++ bfd/ecoff.c 2005-06-21 18:59:49.000000000 +0200
@@ -3182,11 +3182,13 @@ _bfd_ecoff_archive_p (bfd *abfd)
}
bfd_ardata (abfd)->first_file_filepos = SARMAG;
- bfd_ardata (abfd)->cache = NULL;
- bfd_ardata (abfd)->archive_head = NULL;
- bfd_ardata (abfd)->symdefs = NULL;
- bfd_ardata (abfd)->extended_names = NULL;
- bfd_ardata (abfd)->tdata = NULL;
+ /* Already cleared by bfd_zalloc above.
+ bfd_ardata (abfd)->cache = NULL;
+ bfd_ardata (abfd)->archive_head = NULL;
+ bfd_ardata (abfd)->symdefs = NULL;
+ bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0;
+ bfd_ardata (abfd)->tdata = NULL; */
if (! _bfd_ecoff_slurp_armap (abfd)
|| ! _bfd_ecoff_slurp_extended_name_table (abfd))
--- bfd/archive.c.jj 2005-06-17 15:22:56.000000000 +0200
+++ bfd/archive.c 2005-06-21 19:03:51.000000000 +0200
@@ -182,11 +182,13 @@ _bfd_generic_mkarchive (bfd *abfd)
if (bfd_ardata (abfd) == NULL)
return FALSE;
- bfd_ardata (abfd)->cache = NULL;
- bfd_ardata (abfd)->archive_head = NULL;
- bfd_ardata (abfd)->symdefs = NULL;
- bfd_ardata (abfd)->extended_names = NULL;
- bfd_ardata (abfd)->tdata = NULL;
+ /* Already cleared by bfd_zalloc above.
+ bfd_ardata (abfd)->cache = NULL;
+ bfd_ardata (abfd)->archive_head = NULL;
+ bfd_ardata (abfd)->symdefs = NULL;
+ bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0;
+ bfd_ardata (abfd)->tdata = NULL; */
return TRUE;
}
@@ -335,7 +337,7 @@ get_extended_arelt_filename (bfd *arch,
errno = 0;
/* Skip first char, which is '/' in SVR4 or ' ' in some other variants. */
index = strtol (name + 1, NULL, 10);
- if (errno != 0)
+ if (errno != 0 || index >= bfd_ardata (arch)->extended_names_size)
{
bfd_set_error (bfd_error_malformed_archive);
return NULL;
@@ -405,10 +407,7 @@ _bfd_generic_read_ar_hdr_mag (bfd *abfd,
{
filename = get_extended_arelt_filename (abfd, hdr.ar_name);
if (filename == NULL)
- {
- bfd_set_error (bfd_error_malformed_archive);
- return NULL;
- }
+ return NULL;
}
/* BSD4.4-style long filename.
Only implemented for reading, so far! */
@@ -629,11 +628,13 @@ bfd_generic_archive_p (bfd *abfd)
}
bfd_ardata (abfd)->first_file_filepos = SARMAG;
- bfd_ardata (abfd)->cache = NULL;
- bfd_ardata (abfd)->archive_head = NULL;
- bfd_ardata (abfd)->symdefs = NULL;
- bfd_ardata (abfd)->extended_names = NULL;
- bfd_ardata (abfd)->tdata = NULL;
+ /* Cleared by bfd_zalloc above.
+ bfd_ardata (abfd)->cache = NULL;
+ bfd_ardata (abfd)->archive_head = NULL;
+ bfd_ardata (abfd)->symdefs = NULL;
+ bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0;
+ bfd_ardata (abfd)->tdata = NULL; */
if (!BFD_SEND (abfd, _bfd_slurp_armap, (abfd))
|| !BFD_SEND (abfd, _bfd_slurp_extended_name_table, (abfd)))
@@ -1067,6 +1068,7 @@ _bfd_slurp_extended_name_table (bfd *abf
strncmp (nextname, "// ", 16) != 0)
{
bfd_ardata (abfd)->extended_names = NULL;
+ bfd_ardata (abfd)->extended_names_size = 0;
return TRUE;
}
@@ -1075,7 +1077,11 @@ _bfd_slurp_extended_name_table (bfd *abf
return FALSE;
amt = namedata->parsed_size;
- bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt);
+ if (amt + 1 == 0)
+ goto byebye;
+
+ bfd_ardata (abfd)->extended_names_size = amt;
+ bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt + 1);
if (bfd_ardata (abfd)->extended_names == NULL)
{
byebye:
@@ -1098,15 +1104,17 @@ _bfd_slurp_extended_name_table (bfd *abf
trailing '/'. DOS/NT created archive often have \ in them
We'll fix all problems here.. */
{
- char *temp = bfd_ardata (abfd)->extended_names;
+ char *ext_names = bfd_ardata (abfd)->extended_names;
+ char *temp = ext_names;
char *limit = temp + namedata->parsed_size;
for (; temp < limit; ++temp)
{
if (*temp == '\012')
- temp[temp[-1] == '/' ? -1 : 0] = '\0';
+ temp[temp > ext_names && temp[-1] == '/' ? -1 : 0] = '\0';
if (*temp == '\\')
*temp = '/';
}
+ *limit = '\0';
}
/* Pad to an even boundary if you have to. */
Jakub