[PATCH 33745] gas: Search the end of version string instead of hardcode 3

[Zheng Bao]

>From 069288db8e3281fb905198f0180dd8a7214272d1 Mon Sep 17 00:00:00 2001
From: Zheng Bao <fishbaoz@hotmail.com>
Date: Sat, 10 Jan 2026 23:33:55 +0800
Subject: [PATCH] gas: Search the end of version string instead of hardcode 3

p points to the first '@'. p[3] assumes there are 3 '@' at p.
But in fact, the versioned_name is a chain, which holds the
@@@ at the head or at the tail. If p is pointing '@@', the
size l would be big, and memmove would copy some trash data.

TEST:
 $ cat poc
         .symver foo,yoo@@@
         .symver foo,yoo@@
 --before--
 $./gas/as-new poc
 poc: Assembler messages:
 poc: Error: multiple versions [`yoo@p'|`yoo@@@'] for symbol `foo'
 poc: Internal error (Segmentation fault).
 Please report this bug.
 --after--
 $./gas/as-new poc
 poc: Assembler messages:
 poc: Error: multiple versions [`yoo@'|`yoo@@@'] for symbol `foo'

https://sourceware.org/bugzilla/show_bug.cgi?id=33745
Signed-off-by: Zheng Bao <fishbaoz@hotmail.com>
---
 gas/config/obj-elf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gas/config/obj-elf.c b/gas/config/obj-elf.c
index 579c1df2dc3..6096aa4c790 100644
--- a/gas/config/obj-elf.c
+++ b/gas/config/obj-elf.c
@@ -2826,14 +2826,15 @@ elf_frob_file_before_adjust (void)
            {
              char *p = strchr (sy_obj->versioned_name->name,
                                ELF_VER_CHR);
+             char *pe = strrchr(p, ELF_VER_CHR) + 1;

              if (sy_obj->rename)
                {
                  /* The @@@ syntax is a special case. If the symbol is
                     not defined, 2 `@'s will be removed from the
                     versioned_name. Otherwise, 1 `@' will be removed.   */
-                 size_t l = strlen (&p[3]) + 1;
-                 memmove (&p[1 + is_defined], &p[3], l);
+                 size_t l = strlen(pe) + 1;
+                 memmove (&p[1 + is_defined], pe, l);
                }

              if (!is_defined)
--
2.34.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/binutils/attachments/20260111/a800784f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-gas-Search-the-end-of-version-string-instead-of-hard.patch
Type: application/octet-stream
Size: 1792 bytes
Desc: 0001-gas-Search-the-end-of-version-string-instead-of-hard.patch
URL: <https://sourceware.org/pipermail/binutils/attachments/20260111/a800784f/attachment.obj>