Remove some static buffers

Fixes possible overflow of a static buffer for powerpc with translated
messages, and on v850 when symbol names are large.

	* archive.c (_bfd_ar_spacepad, _bfd_ar_sizepad): Use auto buf.
	* coff-mcore.c (coff_mcore_relocate_section): Likewise.
	* elf32-ppc.c (ppc_elf_unhandled_reloc): Use asprintf in place
	of fixed size and possibly too small buf for translated message.
	* elf64-ppc.c (ppc64_elf_unhandled_reloc): Likewise.
	* elf32-v850.c (v850_elf_check_relocs): Likewise.
	* ecoff.c (ecoff_type_to_string): Pass in return string buff rather
	than using static buffer2.  Delete dead code.  Remove unnecessary
	parentheses.
	(_bfd_ecoff_print_symbol): Pass auto buff to ecoff_type_to_string.
	* elf32-rx.c (describe_flags): Pass in return string buf rather
	than using static buf.
	(rx_elf_merge_private_bfd_data): Pass buf to describe_flags.
	(rx_elf_print_private_bfd_data): Likewise.
	* mach-o.c (cpusubtype): Pass in return string buffer rather than
	using static buffer.
	(bfd_mach_o_bfd_print_private_bfd_data): Pass buff to cpusubtype.
	* opncls.c (separate_debug_file_exists): Make buffer an auto var.
	(bfd_fill_in_gnu_debuglink_section): Likewise.
	* peXXigen.c (rsrc_resource_name): Pass in return string buffer
	rather than using static buffer.
	(rsrc_sort_entries): Pass buff to rsrc_resource_name.
	* vms-alpha.c (_bfd_vms_write_emh): Pass tbuf to get_vms_time_string.
	* vms-misc.c (get_vms_time_string): Pass in return string tbuf
	rather than using static tbuf.
	* vms.h (get_vms_time_string): Update prototype.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index c49faa318aeed9a0fb10226f33e189df5f45eb8a..6b09a4435465444749d382dfa4b85f27a646a68c 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,32 @@
+2020-12-18  Alan Modra  <amodra@gmail.com>
+
+       * archive.c (_bfd_ar_spacepad, _bfd_ar_sizepad): Use auto buf.
+       * coff-mcore.c (coff_mcore_relocate_section): Likewise.
+       * elf32-ppc.c (ppc_elf_unhandled_reloc): Use asprintf in place
+       of fixed size and possibly too small buf for translated message.
+       * elf64-ppc.c (ppc64_elf_unhandled_reloc): Likewise.
+       * elf32-v850.c (v850_elf_check_relocs): Likewise.
+       * ecoff.c (ecoff_type_to_string): Pass in return string buff rather
+       than using static buffer2.  Delete dead code.  Remove unnecessary
+       parentheses.
+       (_bfd_ecoff_print_symbol): Pass auto buff to ecoff_type_to_string.
+       * elf32-rx.c (describe_flags): Pass in return string buf rather
+       than using static buf.
+       (rx_elf_merge_private_bfd_data): Pass buf to describe_flags.
+       (rx_elf_print_private_bfd_data): Likewise.
+       * mach-o.c (cpusubtype): Pass in return string buffer rather than
+       using static buffer.
+       (bfd_mach_o_bfd_print_private_bfd_data): Pass buff to cpusubtype.
+       * opncls.c (separate_debug_file_exists): Make buffer an auto var.
+       (bfd_fill_in_gnu_debuglink_section): Likewise.
+       * peXXigen.c (rsrc_resource_name): Pass in return string buffer
+       rather than using static buffer.
+       (rsrc_sort_entries): Pass buff to rsrc_resource_name.
+       * vms-alpha.c (_bfd_vms_write_emh): Pass tbuf to get_vms_time_string.
+       * vms-misc.c (get_vms_time_string): Pass in return string tbuf
+       rather than using static tbuf.
+       * vms.h (get_vms_time_string): Update prototype.
+
 2020-12-18  Alan Modra  <amodra@gmail.com>
 
        * coff-z80.c (bfd_howto_type): Make typedef const.

diff --git a/bfd/archive.c b/bfd/archive.c
index 0250d6f5f4e7324cc9226ff7c7f42e83f23c648d..10e1423b82b0958ad928b9fde54a6061e166b03d 100644 (file)
--- a/bfd/archive.c
+++ b/bfd/archive.c
@@ -172,7 +172,7 @@ struct ar_cache
 void
 _bfd_ar_spacepad (char *p, size_t n, const char *fmt, long val)
 {
-  static char buf[20];
+  char buf[20];
   size_t len;
 
   snprintf (buf, sizeof (buf), fmt, val);
@@ -189,7 +189,7 @@ _bfd_ar_spacepad (char *p, size_t n, const char *fmt, long val)
 bfd_boolean
 _bfd_ar_sizepad (char *p, size_t n, bfd_size_type size)
 {
-  static char buf[21];
+  char buf[21];
   size_t len;
 
   snprintf (buf, sizeof (buf), "%-10" BFD_VMA_FMT "u", size);

diff --git a/bfd/coff-mcore.c b/bfd/coff-mcore.c
index fedcb0ab801df510c34e1d1d37d1e0dc6f646cfd..e5005dc3b868d930c0d2e18aa3b988a5c4ffdc31 100644 (file)
--- a/bfd/coff-mcore.c
+++ b/bfd/coff-mcore.c
@@ -392,6 +392,7 @@ coff_mcore_relocate_section (bfd * output_bfd,
       reloc_howto_type *            howto = NULL;
       struct coff_link_hash_entry *  h;
       const char *                  my_name;
+      char buf[SYMNMLEN + 1];
 
       symndx = rel->r_symndx;
       loc = contents + rel->r_vaddr - input_section->vma;
@@ -436,8 +437,6 @@ coff_mcore_relocate_section (bfd * output_bfd,
                my_name = obj_coff_strings (input_bfd) + sym->_n._n_n._n_offset;
              else
                {
-                 static char buf [SYMNMLEN + 1];
-
                  strncpy (buf, sym->_n._n_name, SYMNMLEN);
                  buf[SYMNMLEN] = '\0';
                  my_name = buf;

diff --git a/bfd/ecoff.c b/bfd/ecoff.c
index 22060e7477846889da6123cea01b5048c85f6d42..798e37a5e30b79db7045dedbacb2365303ffdb02 100644 (file)
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -1056,7 +1056,7 @@ ecoff_emit_aggregate (bfd *abfd,
 /* Convert the type information to string format.  */
 
 static char *
-ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
+ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx, char *buff)
 {
   union aux_ext *aux_ptr;
   int bigendian;
@@ -1071,9 +1071,8 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
   unsigned int basic_type;
   int i;
   char buffer1[1024];
-  static char buffer2[1024];
   char *p1 = buffer1;
-  char *p2 = buffer2;
+  char *p2 = buff;
   RNDXR rndx;
 
   aux_ptr = ecoff_data (abfd)->debug_info.external_aux + fdr->iauxBase;
@@ -1239,7 +1238,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
       break;
     }
 
-  p1 += strlen (buffer1);
+  p1 += strlen (p1);
 
   /* If this is a bitfield, get the bitsize.  */
   if (u.ti.fBitfield)
@@ -1248,7 +1247,6 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
 
       bitsize = AUX_GET_WIDTH (bigendian, &aux_ptr[indx++]);
       sprintf (p1, " : %d", bitsize);
-      p1 += strlen (buffer1);
     }
 
   /* Deal with any qualifiers.  */
@@ -1332,7 +1330,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
                               (long) (qualifiers[j].stride));
 
                    else
-                     sprintf (p2, " {%ld bits}", (long) (qualifiers[j].stride));
+                     sprintf (p2, " {%ld bits}", (long) qualifiers[j].stride);
 
                    p2 += strlen (p2);
                    strcpy (p2, "] of ");
@@ -1345,7 +1343,7 @@ ecoff_type_to_string (bfd *abfd, FDR *fdr, unsigned int indx)
     }
 
   strcpy (p2, buffer1);
-  return buffer2;
+  return buff;
 }
 
 /* Return information about ECOFF symbol SYMBOL in RET.  */
@@ -1514,13 +1512,16 @@ _bfd_ecoff_print_symbol (bfd *abfd,
                if (ECOFF_IS_STAB (&ecoff_ext.asym))
                  ;
                else if (ecoffsymbol (symbol)->local)
-                 /* xgettext:c-format */
-                 fprintf (file, _("\n      End+1 symbol: %-7ld   Type:  %s"),
-                          ((long)
-                           (AUX_GET_ISYM (bigendian,
-                                          &aux_base[ecoff_ext.asym.index])
-                            + sym_base)),
-                          ecoff_type_to_string (abfd, fdr, indx + 1));
+                 {
+                   char buff[1024];
+                   /* xgettext:c-format */
+                   fprintf (file, _("\n      End+1 symbol: %-7ld   Type:  %s"),
+                            ((long)
+                             (AUX_GET_ISYM (bigendian,
+                                            &aux_base[ecoff_ext.asym.index])
+                              + sym_base)),
+                            ecoff_type_to_string (abfd, fdr, indx + 1, buff));
+                 }
                else
                  fprintf (file, _("\n      Local symbol: %ld"),
                           ((long) indx
@@ -1546,8 +1547,11 @@ _bfd_ecoff_print_symbol (bfd *abfd,
 
              default:
                if (! ECOFF_IS_STAB (&ecoff_ext.asym))
-                 fprintf (file, _("\n      Type: %s"),
-                          ecoff_type_to_string (abfd, fdr, indx));
+                 {
+                   char buff[1024];
+                   fprintf (file, _("\n      Type: %s"),
+                            ecoff_type_to_string (abfd, fdr, indx, buff));
+                 }
                break;
              }
          }

diff --git a/bfd/elf32-ppc.c b/bfd/elf32-ppc.c
index 9d8fa66f90847e0530088837f88dfa4db62e13c3..77964946deaecd90f3c67f422aa49db2c3c5f038 100644 (file)
--- a/bfd/elf32-ppc.c
+++ b/bfd/elf32-ppc.c
@@ -985,10 +985,12 @@ ppc_elf_unhandled_reloc (bfd *abfd,
 
   if (error_message != NULL)
     {
-      static char buf[60];
-      sprintf (buf, _("generic linker can't handle %s"),
-              reloc_entry->howto->name);
-      *error_message = buf;
+      static char *message;
+      free (message);
+      if (asprintf (&message, _("generic linker can't handle %s"),
+                   reloc_entry->howto->name) < 0)
+       message = NULL;
+      *error_message = message;
     }
   return bfd_reloc_dangerous;
 }

diff --git a/bfd/elf32-rx.c b/bfd/elf32-rx.c
index 3f03ab21f09cf4f7a149232e131a4e60a8886e13..cd239bf8d3cd2d88a452cec5559af1d6b4ef748d 100644 (file)
--- a/bfd/elf32-rx.c
+++ b/bfd/elf32-rx.c
@@ -3086,10 +3086,8 @@ bfd_elf32_rx_set_target_flags (bfd_boolean user_no_warn_mismatch,
    Returns a static pointer.  */
 
 static const char *
-describe_flags (flagword flags)
+describe_flags (flagword flags, char *buf)
 {
-  static char buf [128];
-
   buf[0] = 0;
 
   if (flags & E_FLAG_RX_64BIT_DOUBLES)
@@ -3170,13 +3168,15 @@ rx_elf_merge_private_bfd_data (bfd * ibfd, struct bfd_link_info *info)
            }
          else
            {
+             char buf[128];
+
              _bfd_error_handler (_("there is a conflict merging the"
                                    " ELF header flags from %pB"),
                                  ibfd);
              _bfd_error_handler (_("  the input  file's flags: %s"),
-                                 describe_flags (new_flags));
+                                 describe_flags (new_flags, buf));
              _bfd_error_handler (_("  the output file's flags: %s"),
-                                 describe_flags (old_flags));
+                                 describe_flags (old_flags, buf));
              error = TRUE;
            }
        }
@@ -3195,6 +3195,7 @@ rx_elf_print_private_bfd_data (bfd * abfd, void * ptr)
 {
   FILE * file = (FILE *) ptr;
   flagword flags;
+  char buf[128];
 
   BFD_ASSERT (abfd != NULL && ptr != NULL);
 
@@ -3204,7 +3205,7 @@ rx_elf_print_private_bfd_data (bfd * abfd, void * ptr)
   flags = elf_elfheader (abfd)->e_flags;
   fprintf (file, _("private flags = 0x%lx:"), (long) flags);
 
-  fprintf (file, "%s", describe_flags (flags));
+  fprintf (file, "%s", describe_flags (flags, buf));
   return TRUE;
 }
 

diff --git a/bfd/elf32-v850.c b/bfd/elf32-v850.c
index 88e774b88e499f83bb6931a0a70d2538ce287018..c3507707e774139aae3cb0fe3a130ee654c1c5a5 100644 (file)
--- a/bfd/elf32-v850.c
+++ b/bfd/elf32-v850.c
@@ -144,7 +144,7 @@ v850_elf_check_relocs (bfd *abfd,
                  && (h->other & V850_OTHER_ERROR) == 0)
                {
                  const char * msg;
-                 static char  buff[200]; /* XXX */
+                 char *buff;
 
                  switch (h->other & V850_OTHER_MASK)
                    {
@@ -165,10 +165,14 @@ v850_elf_check_relocs (bfd *abfd,
                      break;
                    }
 
-                 sprintf (buff, msg, h->root.root.string);
-                 info->callbacks->warning (info, buff, h->root.root.string,
+                 if (asprintf (&buff, msg, h->root.root.string) < 0)
+                   buff = NULL;
+                 else
+                   msg = buff;
+                 info->callbacks->warning (info, msg, h->root.root.string,
                                            abfd, h->root.u.def.section,
                                            (bfd_vma) 0);
+                 free (buff);
 
                  bfd_set_error (bfd_error_bad_value);
                  h->other |= V850_OTHER_ERROR;

diff --git a/bfd/elf64-ppc.c b/bfd/elf64-ppc.c
index f702a0e43a7d2cac71a50c1a64f541985cd37ce5..4f15c8bcea3916425f458c4bbe612ca6e8ffa6f2 100644 (file)
--- a/bfd/elf64-ppc.c
+++ b/bfd/elf64-ppc.c
@@ -1715,10 +1715,12 @@ ppc64_elf_unhandled_reloc (bfd *abfd, arelent *reloc_entry, asymbol *symbol,
 
   if (error_message != NULL)
     {
-      static char buf[60];
-      sprintf (buf, "generic linker can't handle %s",
-              reloc_entry->howto->name);
-      *error_message = buf;
+      static char *message;
+      free (message);
+      if (asprintf (&message, _("generic linker can't handle %s"),
+                   reloc_entry->howto->name) < 0)
+       message = NULL;
+      *error_message = message;
     }
   return bfd_reloc_dangerous;
 }

diff --git a/bfd/mach-o.c b/bfd/mach-o.c
index f285305cd0893b39b0908eac12c9815745ce6f3d..25ae21dbe00cea982939d8567cad859c4b23a2aa 100644 (file)
--- a/bfd/mach-o.c
+++ b/bfd/mach-o.c
@@ -618,10 +618,8 @@ cputype (unsigned long value)
 }
 
 static const char *
-cpusubtype (unsigned long cpu_type, unsigned long cpu_subtype)
+cpusubtype (unsigned long cpu_type, unsigned long cpu_subtype, char *buffer)
 {
-  static char buffer[128];
-
   buffer[0] = 0;
   switch (cpu_subtype & BFD_MACH_O_CPU_SUBTYPE_MASK)
     {
@@ -695,13 +693,14 @@ bfd_mach_o_bfd_print_private_bfd_data (bfd *abfd, void *ptr)
 {
   FILE * file = (FILE *) ptr;
   bfd_mach_o_data_struct *mdata = bfd_mach_o_get_data (abfd);
+  char buff[128];
 
   fprintf (file, _(" MACH-O header:\n"));
   fprintf (file, _("   magic:      %#lx\n"), (long) mdata->header.magic);
   fprintf (file, _("   cputype:    %#lx (%s)\n"), (long) mdata->header.cputype,
           cputype (mdata->header.cputype));
   fprintf (file, _("   cpusubtype: %#lx%s\n"), (long) mdata->header.cpusubtype,
-          cpusubtype (mdata->header.cputype, mdata->header.cpusubtype));
+          cpusubtype (mdata->header.cputype, mdata->header.cpusubtype, buff));
   fprintf (file, _("   filetype:   %#lx\n"), (long) mdata->header.filetype);
   fprintf (file, _("   ncmds:      %#lx\n"), (long) mdata->header.ncmds);
   fprintf (file, _("   sizeocmds:  %#lx\n"), (long) mdata->header.sizeofcmds);

diff --git a/bfd/opncls.c b/bfd/opncls.c
index f7696b658ca33f3b025c0722c14a2f6a1b9ae02c..df0bf129fef1428857342d0a9956be5719ba1cd2 100644 (file)
--- a/bfd/opncls.c
+++ b/bfd/opncls.c
@@ -1347,7 +1347,7 @@ DESCRIPTION
 static bfd_boolean
 separate_debug_file_exists (const char *name, void *crc32_p)
 {
-  static unsigned char buffer [8 * 1024];
+  unsigned char buffer[8 * 1024];
   unsigned long file_crc = 0;
   FILE *f;
   bfd_size_type count;
@@ -1765,7 +1765,7 @@ bfd_fill_in_gnu_debuglink_section (bfd *abfd,
   char * contents;
   bfd_size_type crc_offset;
   FILE * handle;
-  static unsigned char buffer[8 * 1024];
+  unsigned char buffer[8 * 1024];
   size_t count;
   size_t filelen;
 

diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c
index 646ad0f0bf55a135daa3fcab9935b6e8e24941b8..b5ccb18f03e738a486d1c38db877734e6861acef 100644 (file)
--- a/bfd/peXXigen.c
+++ b/bfd/peXXigen.c
@@ -3681,9 +3681,8 @@ rsrc_print_name (char * buffer, rsrc_string string)
 }
 
 static const char *
-rsrc_resource_name (rsrc_entry * entry, rsrc_directory * dir)
+rsrc_resource_name (rsrc_entry *entry, rsrc_directory *dir, char *buffer)
 {
-  static char buffer [256];
   bfd_boolean is_string = FALSE;
 
   buffer[0] = 0;
@@ -4015,8 +4014,12 @@ rsrc_sort_entries (rsrc_dir_chain *  chain,
                          || dir->entry->parent->entry == NULL)
                        _bfd_error_handler (_(".rsrc merge failure: duplicate leaf"));
                      else
-                       _bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"),
-                                           rsrc_resource_name (entry, dir));
+                       {
+                         char buff[256];
+
+                         _bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"),
+                                             rsrc_resource_name (entry, dir, buff));
+                       }
                      bfd_set_error (bfd_error_file_truncated);
                      return;
                    }

diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c
index 471e0215e64aa56d55b05036349d90846909beb5..4fb2945c655ddbc2db35bfff3ce7fce6ae1c0a9e 100644 (file)
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@@ -2927,6 +2927,7 @@ static void
 _bfd_vms_write_emh (bfd *abfd)
 {
   struct vms_rec_wr *recwr = &PRIV (recwr);
+  unsigned char tbuf[18];
 
   _bfd_vms_output_alignment (recwr, 2);
 
@@ -2949,7 +2950,7 @@ _bfd_vms_write_emh (bfd *abfd)
     _bfd_vms_output_counted (recwr, "NONAME");
 
   _bfd_vms_output_counted (recwr, BFD_VERSION_STRING);
-  _bfd_vms_output_dump (recwr, get_vms_time_string (), EMH_DATE_LENGTH);
+  _bfd_vms_output_dump (recwr, get_vms_time_string (tbuf), EMH_DATE_LENGTH);
   _bfd_vms_output_fill (recwr, 0, EMH_DATE_LENGTH);
   _bfd_vms_output_end (abfd, recwr);
 }

diff --git a/bfd/vms-misc.c b/bfd/vms-misc.c
index 70dd0030d53db4cdc1dd0857873e1741f1366512..bc806ca994968b8e4183b305cab33872a60dea68 100644 (file)
--- a/bfd/vms-misc.c
+++ b/bfd/vms-misc.c
@@ -456,9 +456,8 @@ _bfd_vms_convert_to_var_unix_filename (const char *unix_filename)
    stolen from obj-vms.c.  */
 
 unsigned char *
-get_vms_time_string (void)
+get_vms_time_string (unsigned char *tbuf)
 {
-  static unsigned char tbuf[18];
 #ifndef VMS
   char *pnt;
   time_t timeb;

diff --git a/bfd/vms.h b/bfd/vms.h
index 88cf83e4820cfa4f8eab1b49f5f47d46f7fef0d4..d9726b46af0a328289fe455b6409ce7362b5313e 100644 (file)
--- a/bfd/vms.h
+++ b/bfd/vms.h
@@ -111,7 +111,7 @@ extern void _bfd_hexdump   (int, unsigned char *, int, int);
 #endif
 
 extern char * vms_get_module_name (const char *, bfd_boolean);
-extern unsigned char *get_vms_time_string (void);
+extern unsigned char *get_vms_time_string (unsigned char *);
 extern time_t vms_time_to_time_t (unsigned int hi, unsigned int lo);
 extern time_t vms_rawtime_to_time_t (unsigned char *);
 extern void vms_time_t_to_vms_time (time_t ut, unsigned int *hi, unsigned int *lo);