if (bfd_seek (abfd, oldpos, 0) != 0)
return;
section->reloc_count = hdr->s_nreloc = n.r_vaddr - 1;
+ /* PR binutils/17512: Stop corrupt files from causing
+ memory problems if they claim to have too many relocs. */
+ if (section->reloc_count * relsz > (bfd_size_type) bfd_get_size (abfd))
+ {
+ (*_bfd_error_handler)
+ ("%s: warning: claims to have %#x relocs, but the file is not that big",
+ bfd_get_filename (abfd), section->reloc_count);
+ section->reloc_count = 0;
+ }
section->rel_filepos += relsz;
}
else if (hdr->s_nreloc == 0xffff)
const coff_symbol_type *s1 = (const coff_symbol_type *) (al1->u.sym);
const coff_symbol_type *s2 = (const coff_symbol_type *) (al2->u.sym);
+ if (s1 == NULL || s2 == NULL)
+ return 0;
if (s1->symbol.value < s2->symbol.value)
return -1;
else if (s1->symbol.value > s2->symbol.value)
BFD_ASSERT (asect->lineno == NULL);
amt = ((bfd_size_type) asect->lineno_count + 1) * sizeof (alent);
- lineno_cache = (alent *) bfd_alloc (abfd, amt);
+ if (amt > (bfd_size_type) bfd_get_size (abfd))
+ return FALSE;
+ lineno_cache = (alent *) bfd_zalloc (abfd, amt);
if (lineno_cache == NULL)
return FALSE;
((symndx + obj_raw_syments (abfd))
->u.syment._n._n_n._n_zeroes));
cache_ptr->u.sym = (asymbol *) sym;
+ if (sym == NULL)
+ continue;
+
if (sym->lineno != NULL)
(*_bfd_error_handler)
(_("%B: warning: duplicate line number information for `%s'"),
/* Create the new sorted table. */
amt = ((bfd_size_type) asect->lineno_count + 1) * sizeof (alent);
- n_lineno_cache = (alent *) bfd_alloc (abfd, amt);
+ n_lineno_cache = (alent *) bfd_zalloc (abfd, amt);
if (n_lineno_cache != NULL)
{
alent *n_cache_ptr = n_lineno_cache;
/* Copy the function entry and update it. */
*n_cache_ptr = *old_ptr;
- sym = (coff_symbol_type *)n_cache_ptr->u.sym;
- sym->lineno = n_cache_ptr;
+ sym = (coff_symbol_type *) n_cache_ptr->u.sym;
+ if (sym != NULL)
+ sym->lineno = n_cache_ptr;
n_cache_ptr++;
old_ptr++;
n_cache_ptr->line_number = 0;
memcpy (lineno_cache, n_lineno_cache, amt);
}
- bfd_release (abfd, func_table);
+ /* PR binutils/17512: Do *not* free the func table
+ and new lineno cache - they are now being used. */
}
}
fprintf (file, "\t%lx%08lx\t %4lx%08lx <none>",
member_high, member,
WithoutHighBit (member_high), member);
+ /* PR binutils/17512: Handle corrupt PE data. */
+ else if (member - adj + 2 >= datasize)
+ fprintf (file, _("\t<corrupt: 0x%04lx>"), member);
else
{
int ordinal;
if (HighBitSet (member))
fprintf (file, "\t%04lx\t %4lu <none>",
member, WithoutHighBit (member));
+ /* PR binutils/17512: Handle corrupt PE data. */
+ else if (member - adj + 2 >= datasize)
+ fprintf (file, _("\t<corrupt: 0x%04lx>"), member);
else
{
int ordinal;
(long) edt.num_names);
else for (i = 0; i < edt.num_names; ++i)
{
- bfd_vma name_ptr = bfd_get_32 (abfd,
- data +
- edt.npt_addr
- + (i*4) - adj);
+ bfd_vma name_ptr;
+ bfd_vma ord;
- char *name = (char *) data + name_ptr - adj;
+ ord = bfd_get_16 (abfd, data + edt.ot_addr + (i * 2) - adj);
+ name_ptr = bfd_get_32 (abfd, data + edt.npt_addr + (i * 4) - adj);
- bfd_vma ord = bfd_get_16 (abfd,
- data +
- edt.ot_addr
- + (i*2) - adj);
- fprintf (file,
- "\t[%4ld] %s\n", (long) ord, name);
+ if ((name_ptr - adj) >= datasize)
+ {
+ fprintf (file, _("\t[%4ld] <corrupt offset: %lx>\n"),
+ (long) ord, (long) name_ptr);
+ }
+ else
+ {
+ char * name = (char *) data + name_ptr - adj;
+
+ fprintf (file, "\t[%4ld] %s\n", (long) ord, name);
+ }
}
free (data);
rsrc_print_resource_directory (FILE * , bfd *, unsigned int, bfd_byte *,
rsrc_regions *, bfd_vma);
+/* Print the resource entry at DATA, with the text indented by INDENT.
+ Recusively calls rsrc_print_resource_directory to print the contents
+ of directory entries.
+ Returns the address of the end of the data associated with the entry
+ or section_end + 1 upon failure. */
+
static bfd_byte *
rsrc_print_resource_entries (FILE * file,
bfd * abfd,
fprintf (file, _("%03x %*.s Entry: "), (int)(data - regions->section_start), indent, " ");
- entry = (long) bfd_get_32 (abfd, data);
+ entry = (unsigned long) bfd_get_32 (abfd, data);
if (is_name)
{
bfd_byte * name;
else
name = regions->section_start + entry - rva_bias;
- if (name + 2 < regions->section_end)
+ if (name + 2 < regions->section_end && name > regions->section_start)
{
unsigned int len;
len = bfd_get_16 (abfd, name);
fprintf (file, _("name: [val: %08lx len %d]: "), entry, len);
+
if (name + 2 + len * 2 < regions->section_end)
{
/* This strange loop is to cope with multibyte characters. */
while (len --)
{
+ char c;
+
name += 2;
- fprintf (file, "%.1s", name);
+ c = * name;
+ /* Avoid printing control characters. */
+ if (c > 0 && c < 32)
+ fprintf (file, "^%c", c + 64);
+ else
+ fprintf (file, "%.1s", name);
}
}
else
- fprintf (file, _("<corrupt string length: %#x>"), len);
+ {
+ fprintf (file, _("<corrupt string length: %#x>\n"), len);
+ /* PR binutils/17512: Do not try to continue decoding a
+ corrupted resource section. It is likely to end up with
+ reams of extraneous output. FIXME: We could probably
+ continue if we disable the printing of strings... */
+ return regions->section_end + 1;
+ }
}
else
- fprintf (file, _("<corrupt string offset: %#lx>"), entry);
+ {
+ fprintf (file, _("<corrupt string offset: %#lx>\n"), entry);
+ return regions->section_end + 1;
+ }
}
else
fprintf (file, _("ID: %#08lx"), entry);
fprintf (file, _(", Value: %#08lx\n"), entry);
if (HighBitSet (entry))
- return rsrc_print_resource_directory (file, abfd, indent + 1,
- regions->section_start + WithoutHighBit (entry),
- regions, rva_bias);
+ {
+ data = regions->section_start + WithoutHighBit (entry);
+ if (data <= regions->section_start || data > regions->section_end)
+ return regions->section_end + 1;
+
+ /* FIXME: PR binutils/17512: A corrupt file could contain a loop
+ in the resource table. We need some way to detect this. */
+ return rsrc_print_resource_directory (file, abfd, indent + 1, data,
+ regions, rva_bias);
+ }
if (regions->section_start + entry + 16 >= regions->section_end)
return regions->section_end + 1;
case 0: fprintf (file, "Type"); break;
case 2: fprintf (file, "Name"); break;
case 4: fprintf (file, "Language"); break;
- default: fprintf (file, "<unknown>"); break;
+ default:
+ fprintf (file, _("<unknown directory type: %d>\n"), indent);
+ /* FIXME: For now we end the printing here. If in the
+ future more directory types are added to the RSRC spec
+ then we will need to change this. */
+ return regions->section_end + 1;
}
fprintf (file, _(" Table: Char: %d, Time: %08lx, Ver: %d/%d, Num Names: %d, IDs: %d\n"),
}
if (regions.strings_start != NULL)
- fprintf (file, " String table starts at %03x\n",
+ fprintf (file, " String table starts at offset: %#03x\n",
(int) (regions.strings_start - regions.section_start));
if (regions.resource_start != NULL)
- fprintf (file, " Resources start at %03xx\n",
+ fprintf (file, " Resources start at offset: %#03x\n",
(int) (regions.resource_start - regions.section_start));
free (regions.section_start);
_bfd_XXi_swap_debugdir_in (abfd, ext, &idd);
- if ((idd.Type) > IMAGE_NUMBEROF_DEBUG_TYPES)
+ if ((idd.Type) >= IMAGE_NUMBEROF_DEBUG_TYPES)
type_name = debug_type_names[0];
else
type_name = debug_type_names[idd.Type];
else
name = datastart + entry - rva_bias;
- if (name + 2 >= dataend)
+ if (name + 2 >= dataend || name < datastart)
return dataend + 1;
unsigned int len = bfd_get_16 (abfd, name);
entry = (long) bfd_get_32 (abfd, data + 4);
if (HighBitSet (entry))
- return rsrc_count_directory (abfd,
- datastart,
- datastart + WithoutHighBit (entry),
- dataend, rva_bias);
+ {
+ data = datastart + WithoutHighBit (entry);
+
+ if (data <= datastart || data >= dataend)
+ return dataend + 1;
+
+ return rsrc_count_directory (abfd, datastart, data, dataend, rva_bias);
+ }
if (datastart + entry + 16 >= dataend)
return dataend + 1;
if (is_name)
{
- /* FIXME: Add range checking ? */
+ bfd_byte * address;
+
if (HighBitSet (val))
{
val = WithoutHighBit (val);
- entry->name_id.name.len = bfd_get_16 (abfd, datastart + val);
- entry->name_id.name.string = datastart + val + 2;
+ address = datastart + val;
}
else
{
- entry->name_id.name.len = bfd_get_16 (abfd, datastart + val
- - rva_bias);
- entry->name_id.name.string = datastart + val - rva_bias + 2;
+ address = datastart + val - rva_bias;
}
+
+ if (address + 3 > dataend)
+ return dataend;
+
+ entry->name_id.name.len = bfd_get_16 (abfd, address);
+ entry->name_id.name.string = address + 2;
}
else
entry->name_id.id = val;
projects / binutils-gdb.git / commitdiff