[PATCH] Fix for reads of unallocated memory in ld

[Douglas B Rupp]

I don't have commit privileges, could someone please review, and if 
found satisfactory, apply this patch?

--Douglas Rupp
AdaCore

Patch attached for errors found with valgrind while working on 
arm-wrs-vxworks-ld, e.g.:

==13043== Invalid read of size 1
==13043==    at 0x4935A2: iterative_hash (hashtab.c:974)
...
==13043==  Address 0x66e0e1b is not stack'd, malloc'd or (recently) free'd

It's not specific to arm-wrs-vxworks.  The problem is there's a path 
through elf-eh-frame.c/skip_non_nops() that doesn't set the return value 
properly, and leaves it off by 1.  Later on this value, which should be 
0, causes a problem is in this bit of code also in bfd/elf-eh-frame.c:

       insns_end = skip_non_nops (insns, end, length, &set_loc_count);
...
       this_inf->size -= end - insns_end;
       if (insns_end != end && this_inf->cie)
         {
           cie->initial_insn_length -= end - insns_end;
           cie->length -= end - insns_end;
         }

If cie->initial_insn_length is 0, the subtraction underflows to 255 
which is a bogus value. When the hashing function gets ahold of the 
value, it starts reading unallocated memory.
-------------- next part --------------
2014-05-12  Douglas B Rupp  <rupp@adacore.com>

bfd/
	* elf-eh-frame.c (skip_non_nops): Set last when buf
	incremented.

Index: elf-eh-frame.c
===================================================================
RCS file: /cvs/src/src/bfd/elf-eh-frame.c,v
retrieving revision 1.92
diff -u -p -r1.92 elf-eh-frame.c
--- elf-eh-frame.c	21 Feb 2013 02:29:08 -0000	1.92
+++ elf-eh-frame.c	12 May 2014 15:01:57 -0000
@@ -411,7 +411,7 @@ skip_non_nops (bfd_byte *buf, bfd_byte *
   last = buf;
   while (buf < end)
     if (*buf == DW_CFA_nop)
-      buf++;
+      last = ++buf;
     else
       {
 	if (*buf == DW_CFA_set_loc)