Prevent an illegal memory access when running the strings program with an excessively...

  PR 30595
  * strings.c (main): Check for an excessively large minimum string length.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index bb58bc4c5d50a0a21c7b8cabe2a471c7218a9b7c..f06aba238bba42969795ec74ae25a1e6ebcae60a 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2023-06-30  Nick Clifton  <nickc@redhat.com>
+
+       PR 30595
+       * strings.c (main): Check for an excessively large minimum string
+       length.
+
 2023-06-21  Nick Clifton  <nickc@redhat.com>
 
        * testsuite/lib/binutils-common.exp (prune_warnings_extra): Prune

diff --git a/binutils/strings.c b/binutils/strings.c
index e2c1ead6bfd329605fb80d552a002b5cc26c0e8a..f7214fc12282712a9b069919f75711dc293c8f49 100644 (file)
--- a/binutils/strings.c
+++ b/binutils/strings.c
@@ -315,8 +315,14 @@ main (int argc, char **argv)
       if (s != NULL && *s != 0)
        fatal (_("invalid integer argument %s"), argv[numeric_opt - 1] + 1);
     }
+
   if (string_min < 1)
     fatal (_("invalid minimum string length %d"), string_min);
+  /* PR 30595: Look for excessive minimum string lengths.
+     The "(4 * string_min) + 1" is because this is the value
+     used to allocate space in print_unicode_stream().  */
+  else if (string_min == -1U || ((4 * string_min) + 1) == 0)
+    fatal (_("minimum string length %#x is too big"), string_min);
 
   switch (encoding)
     {