* libbfd-in.h (struct artdata): Add extended_names_size field.

* libbfd.h: Rebuilt. * coff-rs600.c (_bfd_xcoff_archive_p): Don't clear fields in freshly allocated object by bfd_zalloc. * coff64-rs6000.c (xcoff64_archive_p): Likewise. * ecoff.c (_bfd_ecoff_archive_p): Likewise. * archive.c (_bfd_generic_mkarchive, bfd_generic_archive_p): Likewise. (get_extended_arelt_filename): Fail if index is bigger or equal to extended_names_size. (_bfd_generic_read_ar_hdr_mag): Don't set bfd_error_malformed_archive, get_extended_arelt_filename already did that. (_bfd_slurp_extended_name_table): Initialize extended_names_size field. Allocate one extra byte and clear it, in case extended names table is not terminated.
2005-07-05 09:45:54 +00:00
parent d0fb9a8d03
commit 9e492e0549
7 changed files with 62 additions and 31 deletions
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,20 @@
 2005-07-05  Jakub Jelinek  <jakub@redhat.com>

+	* libbfd-in.h (struct artdata): Add extended_names_size field.
+	* libbfd.h: Rebuilt.
+	* coff-rs600.c (_bfd_xcoff_archive_p): Don't clear fields in freshly
+	allocated object by bfd_zalloc.
+	* coff64-rs6000.c (xcoff64_archive_p): Likewise.
+	* ecoff.c (_bfd_ecoff_archive_p): Likewise.
+	* archive.c (_bfd_generic_mkarchive, bfd_generic_archive_p): Likewise.
+	(get_extended_arelt_filename): Fail if index is bigger or equal to
+	extended_names_size.
+	(_bfd_generic_read_ar_hdr_mag): Don't set bfd_error_malformed_archive,
+	get_extended_arelt_filename already did that.
+	(_bfd_slurp_extended_name_table): Initialize extended_names_size field.
+	Allocate one extra byte and clear it, in case extended names table
+	is not terminated.
+
 	* libbfd-in.h (bfd_malloc2, bfd_realloc2, bfd_zmalloc2, bfd_alloc2,
 	bfd_zalloc2): New prototypes.
 	* bfd-in.h (HALF_BFD_SIZE_TYPE): Define.
--- a/bfd/archive.c
+++ b/bfd/archive.c
@@ -182,11 +182,13 @@ _bfd_generic_mkarchive (bfd *abfd)
  if (bfd_ardata (abfd) == NULL)
    return FALSE;

-  bfd_ardata (abfd)->cache = NULL;
-  bfd_ardata (abfd)->archive_head = NULL;
-  bfd_ardata (abfd)->symdefs = NULL;
-  bfd_ardata (abfd)->extended_names = NULL;
-  bfd_ardata (abfd)->tdata = NULL;
+  /* Already cleared by bfd_zalloc above.
+     bfd_ardata (abfd)->cache = NULL;
+     bfd_ardata (abfd)->archive_head = NULL;
+     bfd_ardata (abfd)->symdefs = NULL;
+     bfd_ardata (abfd)->extended_names = NULL;
+     bfd_ardata (abfd)->extended_names_size = 0;
+     bfd_ardata (abfd)->tdata = NULL;  */

  return TRUE;
 }
@@ -335,7 +337,7 @@ get_extended_arelt_filename (bfd *arch, const char *name)
  errno = 0;
  /* Skip first char, which is '/' in SVR4 or ' ' in some other variants.  */
  index = strtol (name + 1, NULL, 10);
-  if (errno != 0)
+  if (errno != 0 || index >= bfd_ardata (arch)->extended_names_size)
    {
      bfd_set_error (bfd_error_malformed_archive);
      return NULL;
@@ -405,10 +407,7 @@ _bfd_generic_read_ar_hdr_mag (bfd *abfd, const char *mag)
    {
      filename = get_extended_arelt_filename (abfd, hdr.ar_name);
      if (filename == NULL)
-	{
-	  bfd_set_error (bfd_error_malformed_archive);
-	  return NULL;
-	}
+	return NULL;
    }
  /* BSD4.4-style long filename.
     Only implemented for reading, so far!  */
@@ -629,11 +628,13 @@ bfd_generic_archive_p (bfd *abfd)
    }

  bfd_ardata (abfd)->first_file_filepos = SARMAG;
-  bfd_ardata (abfd)->cache = NULL;
-  bfd_ardata (abfd)->archive_head = NULL;
-  bfd_ardata (abfd)->symdefs = NULL;
-  bfd_ardata (abfd)->extended_names = NULL;
-  bfd_ardata (abfd)->tdata = NULL;
+  /* Cleared by bfd_zalloc above.
+     bfd_ardata (abfd)->cache = NULL;
+     bfd_ardata (abfd)->archive_head = NULL;
+     bfd_ardata (abfd)->symdefs = NULL;
+     bfd_ardata (abfd)->extended_names = NULL;
+     bfd_ardata (abfd)->extended_names_size = 0;
+     bfd_ardata (abfd)->tdata = NULL;  */

  if (!BFD_SEND (abfd, _bfd_slurp_armap, (abfd))
      || !BFD_SEND (abfd, _bfd_slurp_extended_name_table, (abfd)))
@@ -1067,6 +1068,7 @@ _bfd_slurp_extended_name_table (bfd *abfd)
 	  strncmp (nextname, "//              ", 16) != 0)
 	{
 	  bfd_ardata (abfd)->extended_names = NULL;
+	  bfd_ardata (abfd)->extended_names_size = 0;
 	  return TRUE;
 	}

@@ -1075,7 +1077,11 @@ _bfd_slurp_extended_name_table (bfd *abfd)
 	return FALSE;

      amt = namedata->parsed_size;
-      bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt);
+      if (amt + 1 == 0)
+        goto byebye;
+
+      bfd_ardata (abfd)->extended_names_size = amt;
+      bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt + 1);
      if (bfd_ardata (abfd)->extended_names == NULL)
 	{
 	byebye:
@@ -1098,15 +1104,17 @@ _bfd_slurp_extended_name_table (bfd *abfd)
 	 trailing '/'.  DOS/NT created archive often have \ in them
 	 We'll fix all problems here..  */
      {
-	char *temp = bfd_ardata (abfd)->extended_names;
+        char *ext_names = bfd_ardata (abfd)->extended_names;
+	char *temp = ext_names;
 	char *limit = temp + namedata->parsed_size;
 	for (; temp < limit; ++temp)
 	  {
 	    if (*temp == '\012')
-	      temp[temp[-1] == '/' ? -1 : 0] = '\0';
+	      temp[temp > ext_names && temp[-1] == '/' ? -1 : 0] = '\0';
 	    if (*temp == '\\')
 	      *temp = '/';
 	  }
+	*limit = '\0';
      }

      /* Pad to an even boundary if you have to.  */
--- a/bfd/coff-rs6000.c
+++ b/bfd/coff-rs6000.c
@@ -1294,10 +1294,12 @@ _bfd_xcoff_archive_p (abfd)
  if (bfd_ardata (abfd) == (struct artdata *) NULL)
    goto error_ret_restore;

-  bfd_ardata (abfd)->cache = NULL;
-  bfd_ardata (abfd)->archive_head = NULL;
-  bfd_ardata (abfd)->symdefs = NULL;
-  bfd_ardata (abfd)->extended_names = NULL;
+  /* Cleared by bfd_zalloc above.
+     bfd_ardata (abfd)->cache = NULL;
+     bfd_ardata (abfd)->archive_head = NULL;
+     bfd_ardata (abfd)->symdefs = NULL;
+     bfd_ardata (abfd)->extended_names = NULL;
+     bfd_ardata (abfd)->extended_names_size = 0;  */

  /* Now handle the two formats.  */
  if (magic[1] != 'b')
--- a/bfd/coff64-rs6000.c
+++ b/bfd/coff64-rs6000.c
@@ -1983,10 +1983,12 @@ xcoff64_archive_p (abfd)
  if (bfd_ardata (abfd) == (struct artdata *) NULL)
    goto error_ret_restore;

-  bfd_ardata (abfd)->cache = NULL;
-  bfd_ardata (abfd)->archive_head = NULL;
-  bfd_ardata (abfd)->symdefs = NULL;
-  bfd_ardata (abfd)->extended_names = NULL;
+  /* Already cleared by bfd_zalloc above.
+     bfd_ardata (abfd)->cache = NULL;
+     bfd_ardata (abfd)->archive_head = NULL;
+     bfd_ardata (abfd)->symdefs = NULL;
+     bfd_ardata (abfd)->extended_names = NULL;
+     bfd_ardata (abfd)->extended_names_size = 0;  */
  bfd_ardata (abfd)->first_file_filepos = bfd_scan_vma (hdr.firstmemoff,
 							(const char **) NULL,
 							10);
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -3182,11 +3182,13 @@ _bfd_ecoff_archive_p (bfd *abfd)
    }

  bfd_ardata (abfd)->first_file_filepos = SARMAG;
-  bfd_ardata (abfd)->cache = NULL;
-  bfd_ardata (abfd)->archive_head = NULL;
-  bfd_ardata (abfd)->symdefs = NULL;
-  bfd_ardata (abfd)->extended_names = NULL;
-  bfd_ardata (abfd)->tdata = NULL;
+  /* Already cleared by bfd_zalloc above.
+     bfd_ardata (abfd)->cache = NULL;
+     bfd_ardata (abfd)->archive_head = NULL;
+     bfd_ardata (abfd)->symdefs = NULL;
+     bfd_ardata (abfd)->extended_names = NULL;
+     bfd_ardata (abfd)->extended_names_size = 0;
+     bfd_ardata (abfd)->tdata = NULL;  */

  if (! _bfd_ecoff_slurp_armap (abfd)
      || ! _bfd_ecoff_slurp_extended_name_table (abfd))
--- a/bfd/libbfd-in.h
+++ b/bfd/libbfd-in.h
@@ -64,6 +64,7 @@ struct artdata {
  carsym *symdefs;		/* the symdef entries */
  symindex symdef_count;	/* how many there are */
  char *extended_names;		/* clever intel extension */
+  bfd_size_type extended_names_size; /* Size of extended names */
  /* when more compilers are standard C, this can be a time_t */
  long  armap_timestamp;	/* Timestamp value written into armap.
 				   This is used for BSD archives to check
--- a/bfd/libbfd.h
+++ b/bfd/libbfd.h
@@ -69,6 +69,7 @@ struct artdata {
  carsym *symdefs;		/* the symdef entries */
  symindex symdef_count;	/* how many there are */
  char *extended_names;		/* clever intel extension */
+  bfd_size_type extended_names_size; /* Size of extended names */
  /* when more compilers are standard C, this can be a time_t */
  long  armap_timestamp;	/* Timestamp value written into armap.
 				   This is used for BSD archives to check