I: [PATCH] strings section handling fix

[Dmitry V. Levin]

Hi,

The strings utility may mishandle a file if it finds a section with
enormously large size.  In this case, strings attempts to allocate
memory and dies due to OOM.

Original bugreport and test cases could be found at
https://bugzilla.altlinux.org/show_bug.cgi?id=5871

Proposed fix is attached.


-- 
ldv
-------------- next part --------------
binutils/
2005-05-29  Dmitry V. Levin  <ldv@altlinux.org>

	* strings.c (file_namesize_t): New typedef.
	(strings_a_section): Skip sections with size greater or equal
	to file size.
	(strings_object_file): Pass file_namesize_t argument to
	strings_a_section() per bfd_map_over_sections().

--- strings.c	8 May 2005 14:17:39 -0000	1.27
+++ strings.c	29 May 2005 10:51:18 -0000
@@ -151,6 +151,12 @@
   {NULL, 0, NULL, 0}
 };
 
+typedef struct
+{
+  const char *name;
+  bfd_size_type size;
+} file_namesize_t;
+
 static void strings_a_section (bfd *, asection *, void *);
 static bfd_boolean strings_object_file (const char *);
 static bfd_boolean strings_file (char *file);
@@ -319,14 +325,31 @@
    set `got_a_section' and print the strings in it.  */
 
 static void
-strings_a_section (bfd *abfd, asection *sect, void *filearg)
+strings_a_section (bfd *abfd, asection *sect, void *namesize)
 {
-  const char *file = (const char *) filearg;
-
   if ((sect->flags & DATA_FLAGS) == DATA_FLAGS)
     {
+      const char *file = ((file_namesize_t *) namesize)->name;
+      bfd_size_type *sizep = &((file_namesize_t *) namesize)->size;
       bfd_size_type sz = bfd_get_section_size (sect);
-      void *mem = xmalloc (sz);
+      void *mem;
+      
+      if (sz <= 0)
+	return;
+
+      if (*sizep == 0)
+        {
+	  struct stat st;
+
+	  if (bfd_stat(abfd, &st))
+	    return;
+	  *sizep = st.st_size;
+	}
+
+      if (sz >= *sizep)
+	return;
+
+      mem = xmalloc (sz);
 
       if (bfd_get_section_contents (abfd, sect, mem, (file_ptr) 0, sz))
 	{
@@ -346,6 +369,7 @@
 static bfd_boolean
 strings_object_file (const char *file)
 {
+  file_namesize_t namesize;
   bfd *abfd = bfd_openr (file, target);
 
   if (abfd == NULL)
@@ -362,7 +386,9 @@ strings_object_file (const char *file)
     }
 
   got_a_section = FALSE;
-  bfd_map_over_sections (abfd, strings_a_section, (void *) file);
+  namesize.name = file;
+  namesize.size = 0;
+  bfd_map_over_sections (abfd, strings_a_section, (void *) &namesize);
 
   if (!bfd_close (abfd))
     {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20050529/60f9f7fc/attachment.sig>