[binutils-gdb] asan: heap buffer overflow in _bfd_vms_slurp_egsd

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=de6a7ee4bd18b7812ee5ff9abb62e2889daa501b

commit de6a7ee4bd18b7812ee5ff9abb62e2889daa501b
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Jan 5 13:17:24 2021 +1030

    asan: heap buffer overflow in _bfd_vms_slurp_egsd
    
            * vms-alpha.c (_bfd_vms_slurp_egsd): Read flags after size check.

Diff:
---
 bfd/ChangeLog   | 4 ++++
 bfd/vms-alpha.c | 3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 20ccea5920e..4eda3a1e57e 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,7 @@
+2021-01-05  Alan Modra  <amodra@gmail.com>
+
+	* vms-alpha.c (_bfd_vms_slurp_egsd): Read flags after size check.
+
 2021-01-05  Nelson Chu  <nelson.chu@sifive.com>
 
 	* elfnn-riscv.c (allocate_dynrelocs): When we are generating pde,
diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c
index 2c0e8126dc2..72d89e518f6 100644
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@@ -1394,14 +1394,13 @@ _bfd_vms_slurp_egsd (bfd *abfd)
 	    flagword old_flags;
 	    unsigned int nameoff = offsetof (struct vms_egst, namlng);
 
-	    old_flags = bfd_getl16 (egst->header.flags);
-
 	    if (nameoff >= gsd_size)
 	      goto too_small;
 	    entry = add_symbol (abfd, &egst->namlng, gsd_size - nameoff);
 	    if (entry == NULL)
 	      return FALSE;
 
+	    old_flags = bfd_getl16 (egst->header.flags);
 	    entry->typ = gsd_type;
 	    entry->data_type = egst->header.datyp;
 	    entry->flags = old_flags;