* elf.c (bfd_section_from_shdr): Fail if name is NULL.

	Prevent endless recursion on broken objects.

	* archive.c (do_slurp_coff_armap): Check for overflows.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 91240207f5aca5742da85610921edc3a6ad3aee0..3de70879f1b8e3569ddbcff2b35b68b6bc08084a 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,10 @@
+2005-06-14  Jakub Jelinek  <jakub@redhat.com>
+
+       * elf.c (bfd_section_from_shdr): Fail if name is NULL.
+       Prevent endless recursion on broken objects.
+
+       * archive.c (do_slurp_coff_armap): Check for overflows.
+
 2005-06-10  Daniel Jacobowitz  <dan@codesourcery.com>
 
        * elfcode.h (elf_write_relocs): Do nothing if there are no

diff --git a/bfd/archive.c b/bfd/archive.c
index 7dfe6b6726d919dca3f54d10e38037cc0a8ae53a..ce6a3328577ea05fd3fc7ba3bc43976b76054ec4 100644 (file)
--- a/bfd/archive.c
+++ b/bfd/archive.c
@@ -821,9 +821,15 @@ do_slurp_coff_armap (bfd *abfd)
   /* The coff armap must be read sequentially.  So we construct a
      bsd-style one in core all at once, for simplicity.  */
 
+  if (nsymz > ~ (bfd_size_type) 0 / sizeof (carsym))
+    return FALSE;
+
   carsym_size = (nsymz * sizeof (carsym));
   ptrsize = (4 * nsymz);
 
+  if (carsym_size + stringsize + 1 <= carsym_size)
+    return FALSE;
+
   ardata->symdefs = bfd_zalloc (abfd, carsym_size + stringsize + 1);
   if (ardata->symdefs == NULL)
     return FALSE;

diff --git a/bfd/elf.c b/bfd/elf.c
index 189e099fed6b90488cf4ebb5c010ca00fb9ff4c9..5d4e1a309bc2c51240120831cfeff5d3014aa331 100644 (file)
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -1752,6 +1752,8 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
   name = bfd_elf_string_from_elf_section (abfd,
                                          elf_elfheader (abfd)->e_shstrndx,
                                          hdr->sh_name);
+  if (name == NULL)
+    return FALSE;
 
   switch (hdr->sh_type)
     {
@@ -1922,6 +1924,9 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
              Elf_Internal_Shdr *hdr2 = elf_elfsections (abfd)[i];
              if (hdr2->sh_link == shindex)
                {
+                 /* Prevent endless recursion on broken objects.  */
+                 if (i == shindex)
+                   return FALSE;
                  if (! bfd_section_from_shdr (abfd, i))
                    return FALSE;
                  if (elf_onesymtab (abfd) == i)
@@ -1999,6 +2004,10 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
          return _bfd_elf_make_section_from_shdr (abfd, hdr, name,
                                                  shindex);
 
+        /* Prevent endless recursion on broken objects.  */
+        if (elf_elfsections (abfd)[hdr->sh_info]->sh_type == SHT_REL
+            || elf_elfsections (abfd)[hdr->sh_info]->sh_type == SHT_RELA)
+          return FALSE;
        if (! bfd_section_from_shdr (abfd, hdr->sh_info))
          return FALSE;
        target_sect = bfd_section_from_elf_index (abfd, hdr->sh_info);