Re: readelf looping in process_archive

This patch fixes a leak of qualified_name caused by 4c83662712 and a
double free introduced by fd486f32d1.  Not breaking out of the loop
results in an error: "failed to seek to next archive header".  That's
slightly better than silently preventing the possibility of endless
loops.

	* readelf.c (process_archive): Don't double free qualified_name.
	Don't break out of loop with "negative" archive_file_size, just
	set file offset to max.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 2f551f10316efabae4c728ee4678d4c533dc4558..efc2e9e2ae237f322d23ba2e6de1e2349db766b9 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2020-03-27  Alan Modra  <amodra@gmail.com>
+
+       * readelf.c (process_archive): Don't double free qualified_name.
+       Don't break out of loop with "negative" archive_file_size, just
+       set file offset to max.
+
 2020-03-25  Alan Modra  <amodra@gmail.com>
 
        * readelf.c (process_archive): Prevent endless loop.

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 9bc15e4d0b2a7e800988e5b0c3251680cd064069..eb41e10dae939656d68cfbb64361eb7049be28bd 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -20461,7 +20461,6 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
 
          close_file (member_filedata);
          free (member_file_name);
-         free (qualified_name);
        }
       else if (is_thin_archive)
        {
@@ -20511,7 +20510,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
          arch.next_arhdr_offset += archive_file_size;
          /* Stop looping with "negative" archive_file_size.  */
          if (arch.next_arhdr_offset < archive_file_size)
-           break;
+           arch.next_arhdr_offset = -1ul;
        }
 
       free (qualified_name);