ubsan: alpha-vms: segv

I thought the fuzzers were really going overboard by defining
VMS_DEBUG but that wasn't the case.  VMS_DEBUG is defined by
default.  Let's not do that, and fix the segv as well.

	* vms.h (VMS_DEBUG): Define as 0.
	* vms-alpha.c (image_write): Move debug output after bounds check.
	Tidy bounds check.
	(_bfd_vms_slurp_eihd): Warning fix.
	(_bfd_vms_slurp_etir): Init variables to avoid bogus warnings.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 84caf0b04aed3b783dc9f42a3b7c965e8a184c2d..acb545cd03cd43eeb50ab6d19fa99f1fc6e88516 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,11 @@
+2020-01-14  Alan Modra  <amodra@gmail.com>
+
+       * vms.h (VMS_DEBUG): Define as 0.
+       * vms-alpha.c (image_write): Move debug output after bounds check.
+       Tidy bounds check.
+       (_bfd_vms_slurp_eihd): Warning fix.
+       (_bfd_vms_slurp_etir): Init variables to avoid bogus warnings.
+
 2020-01-13  Alan Modra  <amodra@gmail.com>
 
        * vms-alpha.c (_bfd_vms_slurp_egsd): Ensure minimum size even

diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c
index 32f4e68bbba8ab954469cbb8824c324e449c53a8..586a157cb1be9b9e7f68855ab494b6b34633b6b9 100644 (file)
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@@ -503,6 +503,7 @@ _bfd_vms_slurp_eihd (bfd *abfd, unsigned int *eisd_offset,
   vms_debug2 ((4, "EIHD size %d imgtype %d symvva 0x%lx eisd %d eihs %d\n",
               size, imgtype, (unsigned long)symvva,
               *eisd_offset, *eihs_offset));
+  (void) size;
 
   return TRUE;
 }
@@ -1594,18 +1595,16 @@ image_write (bfd *abfd, unsigned char *ptr, unsigned int size)
 #if VMS_DEBUG
   _bfd_vms_debug (8, "image_write from (%p, %d) to (%ld)\n", ptr, size,
                  (long)PRIV (image_offset));
-  _bfd_hexdump (9, ptr, size, 0);
 #endif
 
   if (PRIV (image_section)->contents != NULL)
     {
       asection *sec = PRIV (image_section);
-      file_ptr off = PRIV (image_offset);
+      size_t off = PRIV (image_offset);
 
       /* Check bounds.  */
-      if (off > (file_ptr)sec->size
-         || size > (file_ptr)sec->size
-         || off + size > (file_ptr)sec->size)
+      if (off > sec->size
+         || size > sec->size - off)
        {
          bfd_set_error (bfd_error_bad_value);
          return FALSE;
@@ -1613,6 +1612,9 @@ image_write (bfd *abfd, unsigned char *ptr, unsigned int size)
 
       memcpy (sec->contents + off, ptr, size);
     }
+#if VMS_DEBUG
+  _bfd_hexdump (9, ptr, size, 0);
+#endif
 
   PRIV (image_offset) += size;
   return TRUE;
@@ -1861,10 +1863,10 @@ _bfd_vms_slurp_etir (bfd *abfd, struct bfd_link_info *info)
   unsigned char *ptr;
   unsigned int length;
   unsigned char *maxptr;
-  bfd_vma op1;
-  bfd_vma op2;
-  unsigned int rel1;
-  unsigned int rel2;
+  bfd_vma op1 = 0;
+  bfd_vma op2 = 0;
+  unsigned int rel1 = RELC_NONE;
+  unsigned int rel2 = RELC_NONE;
   struct alpha_vms_link_hash_entry *h;
 
   PRIV (recrd.rec) += ETIR__C_HEADER_SIZE;

diff --git a/bfd/vms.h b/bfd/vms.h
index 2a4fb7e3fe2bba6fcd10f8a274763b69ca702385..88cf83e4820cfa4f8eab1b49f5f47d46f7fef0d4 100644 (file)
--- a/bfd/vms.h
+++ b/bfd/vms.h
@@ -98,7 +98,7 @@ struct evax_private_udata_struct
 
 /* vms-misc.c.  */
 
-#define VMS_DEBUG 1
+#define VMS_DEBUG 0
 
 #if VMS_DEBUG
 extern void _bfd_vms_debug (int, char *, ...) ATTRIBUTE_PRINTF_2;