[PATCH] Fix issues in bfd/doc/chew.c

[Tim Rühsen <tim dot ruehsen at gmx dot de>]

Hi,

tried to "get warm" with libbfd, found those little buggers.

Regards, Tim

From 089a07d89fbfd9691c51b87b12a00701e71372e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Thu, 31 Oct 2019 20:06:41 +0100
Subject: [PATCH 2/2] [bfd/doc] Fix double free() and random free()

* bfd/doc/chew.c (nextword): Always initialize output var.
  (compile): Check return value of nextword().
---
 bfd/doc/chew.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/bfd/doc/chew.c b/bfd/doc/chew.c
index 818f01a7af..1c0b17ddb9 100644
--- a/bfd/doc/chew.c
+++ b/bfd/doc/chew.c
@@ -1167,7 +1167,10 @@ nextword (string, word)
 	}
     }
   if (!*string)
-    return 0;
+    {
+      *word = NULL;
+      return 0;
+    }
 
   word_start = string;
   if (*string == '"')
@@ -1374,6 +1377,8 @@ compile (string)
 	{
 	  free (word);
 	  string = nextword (string, &word);
+	  if (!string)
+	    continue;
 	  add_var (word);
 	  string = nextword (string, &word);
 	}
@@ -1384,8 +1389,16 @@ compile (string)
 	  /* Compile a word and add to dictionary.  */
 	  free (word);
 	  string = nextword (string, &word);
+	  if (!string)
+	    continue;
 	  ptr = newentry (word);
 	  string = nextword (string, &word);
+	  if (!string)
+	    {
+	      free (ptr->code);
+	      free (ptr);
+	      continue;
+	    }
 	  
 	  while (word[0] != ';')
 	    {
@@ -1423,7 +1436,6 @@ compile (string)
 	    }
 	  add_to_definition (ptr, 0);
 	  free (word);
-	  word = NULL;
 	  string = nextword (string, &word);
 	}
       else
-- 
2.24.0.rc1

From f5a3fa2a143499424910abf0e2a8027acc6da773 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Thu, 31 Oct 2019 19:16:35 +0100
Subject: [PATCH 1/2] [bfd/doc] Fix sizeof operand

* bfd/doc/chew.c (add_to_definition): Fix sizeof operand
---
 bfd/doc/chew.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bfd/doc/chew.c b/bfd/doc/chew.c
index ef5a22c2fa..818f01a7af 100644
--- a/bfd/doc/chew.c
+++ b/bfd/doc/chew.c
@@ -1333,7 +1333,7 @@ add_to_definition (entry, word)
       entry->code_length += 2;
       entry->code =
 	(stinst_type *) realloc ((char *) (entry->code),
-				 entry->code_length * sizeof (word_type));
+				 entry->code_length * sizeof (stinst_type));
     }
   entry->code[entry->code_end] = word;
 
-- 
2.24.0.rc1

Attachment: signature.asc
Description: OpenPGP digital signature