Imagelibrary/binutils-gdb
1
0
Fork 1
mirror of https://github.com/bminor/binutils-gdb.git synced 2025-11-16 12:34:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

asan: segfault in coff_mangle_symbols

Browse Source 
The testcase managed to trigger creation of a wild pointer in
coff_slurp_symbol_table.  Stop that happening, and fix an unrelated
problem I happened to see in bfd_coff_get_syment.

	* coff-bfd.c (bfd_coff_get_syment): Clear fix_value after
	converting n_value from a pointer to an index.
	* coffcode.h (coff_slurp_symbol_table <C_BSTAT>): Sanity check
	symbol value before converting to a pointer.
This commit is contained in:
Alan Modra
2023-04-24 11:19:15 +09:30
parent c1eb3cd205
commit 2043ddb218
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
bfd/coff-bfd.c
View File

@@ -45,9 +45,12 @@ bfd_coff_get_syment (bfd *abfd,
*psyment = csym->native->u.syment;
if (csym->native->fix_value)
{
psyment->n_value =
((psyment->n_value - (uintptr_t) obj_raw_syments (abfd))
/ sizeof (combined_entry_type));
csym->native->fix_value = 0;
}
/* FIXME: We should handle fix_line here. */

5
bfd/coffcode.h
View File

@@ -4852,6 +4852,10 @@ coff_slurp_symbol_table (bfd * abfd)
case C_BSTAT:
dst->symbol.flags = BSF_DEBUGGING;
if (src->u.syment.n_value >= obj_raw_syment_count (abfd))
dst->symbol.value = 0;
else
{
/* The value is actually a symbol index. Save a pointer
to the symbol instead of the index. FIXME: This
should use a union. */
@@ -4859,6 +4863,7 @@ coff_slurp_symbol_table (bfd * abfd)
= (uintptr_t) (native_symbols + src->u.syment.n_value);
dst->symbol.value = src->u.syment.n_value;
src->fix_value = 1;
}
break;
#endif