Fixes a problem with the BFD library running out of memory because it mistakenly

thought that an uncompressed .debug_str section was compressed.

	* compress.c (bfd_is_section_compressed): When checking the
	.debug_str section, also check the fifth byte in the section is
	not part of a string.

	* binutils-all/debug_str.s: New test.
	* binutils-all/debug_str.d: New test control file.
	* binutils-all/compress.exp: Run debug_str test.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 4a4d3cf24aa6130fb98b07644c54360be9abbf33..414ebab6398eceede7cbe4d0fc538dae7cfe3688 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2014-04-30  Nick Clifton  <nickc@redhat.com>
+
+       * compress.c (bfd_is_section_compressed): When checking the
+       .debug_str section, also check the fifth byte in the section is
+       not part of a string.
+
 2014-04-30  Alan Modra  <amodra@gmail.com>
 
        * elf-eh-frame.c (struct cie.personality): Replace val with sym.

diff --git a/bfd/compress.c b/bfd/compress.c
index 5a289e62e808e7cf5bcec5a97fe46def075d6e01..20eef9528265e905e9b7220e38520625cfb15dea 100644 (file)
--- a/bfd/compress.c
+++ b/bfd/compress.c
@@ -24,6 +24,7 @@
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#include "safe-ctype.h"
 
 #ifdef HAVE_ZLIB_H
 static bfd_boolean
@@ -303,6 +304,15 @@ bfd_is_section_compressed (bfd *abfd, sec_ptr sec)
   compressed = (bfd_get_section_contents (abfd, sec, compressed_buffer, 0, 12)
                && CONST_STRNEQ ((char*) compressed_buffer, "ZLIB"));
 
+  /* Check for the pathalogical case of a debug string section that
+     contains the string ZLIB.... as the first entry.  We assume that
+     no uncompressed .debug_str section would ever be big enough to
+     have the first byte of its (big-endian) size be non-zero.  */
+  if (compressed
+      && strcmp (sec->name, ".debug_str") == 0
+      && ISPRINT (compressed_buffer[4]))
+    compressed = FALSE;
+
   /* Restore compress_status.  */
   sec->compress_status = saved;
   return compressed;

diff --git a/binutils/testsuite/ChangeLog b/binutils/testsuite/ChangeLog
index a308b638217cd3296c472101055fa3fa71ba8907..1231a24b8cf3e6fd21c67fb85a93b0d46b46174d 100644 (file)
--- a/binutils/testsuite/ChangeLog
+++ b/binutils/testsuite/ChangeLog
@@ -1,3 +1,9 @@
+2014-04-30  Nick Clifton  <nickc@redhat.com>
+
+       * binutils-all/debug_str.s: New test.
+       * binutils-all/debug_str.d: New test control file.
+       * binutils-all/compress.exp: Run debug_str test.
+
 2014-04-22  Christian Svensson  <blue@cmd.nu>
 
        * binutils-all/objcopy.exp: Remove openrisc and or32 support.  Add

diff --git a/binutils/testsuite/binutils-all/compress.exp b/binutils/testsuite/binutils-all/compress.exp
index 570425be119d41b02b4c2afd1f10e6f553c23e44..d74555dc75c2ace7551c5b9c5c1edd19bcf62599 100644 (file)
--- a/binutils/testsuite/binutils-all/compress.exp
+++ b/binutils/testsuite/binutils-all/compress.exp
@@ -173,3 +173,13 @@ if ![string match "" $got] then {
        fail "objcopy ($testname)"
     }
 }
+
+if ![is_remote host] {
+    set tempfile tmpdir/debug_str.o
+    set copyfile tmpdir/debug_str.copy
+} else {
+    set tempfile [remote_download host tmpdir/debug_str.o]
+    set copyfile debug_str.copy
+}
+
+run_dump_test "debug_str"

diff --git a/binutils/testsuite/binutils-all/debug_str.d b/binutils/testsuite/binutils-all/debug_str.d
new file mode 100644 (file)
index 0000000..eda1db1
--- /dev/null
+++ b/binutils/testsuite/binutils-all/debug_str.d
@@ -0,0 +1,9 @@
+#PROG: objcopy
+#source: debug_str.s
+#objdump: -h
+#name: Uncompressed .debug_str section starting with ZLIB
+
+.*ebug_str.copy.o:     file format .*
+#...
+  . .debug_str    0+01.  0+0  0+0  0+0..  2..0
+#...

diff --git a/binutils/testsuite/binutils-all/debug_str.s b/binutils/testsuite/binutils-all/debug_str.s
new file mode 100644 (file)
index 0000000..485d0cc
--- /dev/null
+++ b/binutils/testsuite/binutils-all/debug_str.s
@@ -0,0 +1,12 @@
+/*      This test is derived from a C source file which, when compiled by gcc
+       with debugging enabled, managed to create a .debug_str section whose
+       first string was ZLIB_VER_SUBVERSION.   The code in bfd/compress.c
+       used to just check for the characters "ZLIB" at the start of a section
+       and then assume that the section was compressed.  This meant that the BFD
+       library then processed the next 8 bytes as if they were the size of the
+       decompressed version of the section.  Naturally with this test case the 
+       resulting size was gigantic and consequently the library quickly ran out
+       of memory.  */
+
+       .section        .debug_str,"MS",@progbits,1
+       .string "ZLIB_VER_SUBREVISION 0"