[binutils-gdb] Fix an assertion failure in the BFD library when parsing a corrupt SREC format file.

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=33fe00c1232fa22c6c5f0099c1268a707f64b786

commit 33fe00c1232fa22c6c5f0099c1268a707f64b786
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Apr 21 11:09:11 2021 +0100

    Fix an assertion failure in the BFD library when parsing a corrupt SREC format file.
    
            PR 27759
            * srec.c (srec_read_section): Replace assertions with error
            returns.

Diff:
---
 bfd/ChangeLog |  6 ++++++
 bfd/srec.c    | 12 ++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 972311bce48..85f4f37de1e 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2021-04-21  Nick Clifton  <nickc@redhat.com>
+
+	PR 27759
+	* srec.c (srec_read_section): Replace assertions with error
+	returns.
+
 2021-04-20  Clément Chigot  <clement.chigot@atos.net>
 
 	PR binutils/21700
diff --git a/bfd/srec.c b/bfd/srec.c
index 3ddb3c56e33..9628691ad8f 100644
--- a/bfd/srec.c
+++ b/bfd/srec.c
@@ -733,7 +733,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
 
       /* This is called after srec_scan has already been called, so we
 	 ought to know the exact format.  */
-      BFD_ASSERT (c == 'S');
+      if (c != 'S')
+	goto error_return;
 
       if (bfd_bread (hdr, (bfd_size_type) 3, abfd) != 3)
 	goto error_return;
@@ -759,7 +760,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
       switch (hdr[0])
 	{
 	default:
-	  BFD_ASSERT (sofar == section->size);
+	  if (sofar != section->size)
+	    goto error_return;
 	  free (buf);
 	  return true;
 
@@ -783,7 +785,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
 	  if (address != section->vma + sofar)
 	    {
 	      /* We've come to the end of this section.  */
-	      BFD_ASSERT (sofar == section->size);
+	      if (sofar != section->size)
+		goto error_return;
 	      free (buf);
 	      return true;
 	    }
@@ -805,7 +808,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
   if (error)
     goto error_return;
 
-  BFD_ASSERT (sofar == section->size);
+  if (sofar != section->size)
+    goto error_return;
 
   free (buf);
   return true;