Prevent a seg-fault in gprof when parsing a corrupt core file.

	PR gprof/20499
	* corefile.c (core_create_syms_from): Avoid walking off the end of
	the symbol table.

diff --git a/gprof/ChangeLog b/gprof/ChangeLog
index 83e8d1706b91566ca5c9d6df7e8f8501b0f0e436..eabc188ca38bf08d7c08cfdea0d961d378efc8ea 100644 (file)
--- a/gprof/ChangeLog
+++ b/gprof/ChangeLog
@@ -1,3 +1,9 @@
+2016-08-22  Nick Clifton  <nickc@redhat.com>
+
+       PR gprof/20499
+       * corefile.c (core_create_syms_from): Avoid walking off the end of
+       the symbol table.
+
 2016-07-21  H.J. Lu  <hongjiu.lu@intel.com>
 
        * configure: Regenerated.

diff --git a/gprof/corefile.c b/gprof/corefile.c
index 37942b564addb3bf91829ff81e83a851a9f9992c..93a0e94e55465670f9896007bfa46669f3c43570 100644 (file)
--- a/gprof/corefile.c
+++ b/gprof/corefile.c
@@ -553,6 +553,13 @@ core_create_syms_from (const char * sym_table_file)
         if (type != 't' && type != 'T')
           continue;
 
+      /* PR 20499 */
+      if ((symtab.limit - symtab.base) >= symtab.len)
+       {
+         fprintf (stderr, _("%s: too many symbols in file '%s'\n"), whoami, sym_table_file);
+         done (1);
+       }
+
       sym_init (symtab.limit);
 
       sscanf (address, "%" BFD_VMA_FMT "x", &(symtab.limit->addr) );