[PATCH 33745] gas: Search the end of version string instead of hardcode 3

[Zheng Bao]

A better patch is uploaded to bugzilla. Ignore this patch.

Zheng
________________________________
From: Zheng Bao <fishbaoz@hotmail.com>
Sent: Sunday, January 11, 2026 3:04 PM
To: Andreas Schwab <schwab@linux-m68k.org>
Cc: binutils@sourceware.org <binutils@sourceware.org>
Subject: Re: [PATCH 33745] gas: Search the end of version string instead of hardcode 3

>From f22ad4385169c2e465dd8ba58f7be98d0b37decf Mon Sep 17 00:00:00 2001
From: Zheng Bao <fishbaoz@hotmail.com>
Date: Sat, 10 Jan 2026 23:33:55 +0800
Subject: [PATCH] gas: Search the end of version string instead of using
 hardcode

p points to the first '@'. p[3] assumes there are 3 '@' at p.
But in fact, the versioned_name is a chain, which holds the
@@@ at the head or at the tail. If p is pointing '@@', the
size l would be bigger, and memmove would copy some trash data.

TEST:
 $ cat poc
         .symver foo,yoo@@@
         .symver foo,yoo@@
 --before--
 $./gas/as-new poc
 poc: Assembler messages:
 poc: Error: multiple versions [`yoo@p'|`yoo@@@'] for symbol `foo'
 poc: Internal error (Segmentation fault).
 Please report this bug.
 --after--
 $./gas/as-new poc
 poc: Assembler messages:
 poc: Error: multiple versions [`yoo@'|`yoo@@@'] for symbol `foo'

https://sourceware.org/bugzilla/show_bug.cgi?id=33745
Signed-off-by: Zheng Bao <fishbaoz@hotmail.com>
---
 gas/config/obj-elf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gas/config/obj-elf.c b/gas/config/obj-elf.c
index 579c1df2dc3..151654e10b4 100644
--- a/gas/config/obj-elf.c
+++ b/gas/config/obj-elf.c
@@ -2826,14 +2826,15 @@ elf_frob_file_before_adjust (void)
            {
              char *p = strchr (sy_obj->versioned_name->name,
                                ELF_VER_CHR);
+             char *pe = strrchr (p, ELF_VER_CHR) + 1;

              if (sy_obj->rename)
                {
                  /* The @@@ syntax is a special case. If the symbol is
                     not defined, 2 `@'s will be removed from the
                     versioned_name. Otherwise, 1 `@' will be removed.   */
-                 size_t l = strlen (&p[3]) + 1;
-                 memmove (&p[1 + is_defined], &p[3], l);
+                 size_t l = strlen (&pe[0]) + 1;
+                 memmove (&p[1 + is_defined], &pe[0], l);
                }

              if (!is_defined)
--
2.34.1
________________________________
From: Andreas Schwab <schwab@linux-m68k.org>
Sent: Sunday, January 11, 2026 10:50 AM
To: Zheng Bao <fishbaoz@hotmail.com>
Cc: binutils@sourceware.org <binutils@sourceware.org>
Subject: Re: [PATCH 33745] gas: Search the end of version string instead of hardcode 3

On Jan 11 2026, Zheng Bao wrote:

> +             char *pe = strrchr(p, ELF_VER_CHR) + 1;
> +                 size_t l = strlen(pe) + 1;

Space before paren.

--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/binutils/attachments/20260111/c34a0f21/attachment-0001.htm>