Fix buffer overrun parsing a corrupt tekhex binary.

	PR binutils/21962
	* tekhex.c (getsym): Fix check for source pointer walking off the
	end of the input buffer.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index e1985a44d3951f7e4cb286553f50d687cf63063f..79dfa1dc145f7323ef63b779d49e58f47d66df08 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2017-08-18  Nick Clifton  <nickc@redhat.com>
+
+       PR binutils/21962
+       * tekhex.c (getsym): Fix check for source pointer walking off the
+       end of the input buffer.
+
 2017-08-17  Szabolcs Nagy  <szabolcs.nagy@arm.com>
 
        PR ld/18808

diff --git a/bfd/tekhex.c b/bfd/tekhex.c
index 1d605d5e3736cc8baf94e4b2a6d7fb439a00c607..cb4b624d40858013e183a6e812ac38dc666b2125 100644 (file)
--- a/bfd/tekhex.c
+++ b/bfd/tekhex.c
@@ -307,7 +307,7 @@ getsym (char *dstp, char **srcp, unsigned int *lenp, char * endp)
   len = hex_value (*src++);
   if (len == 0)
     len = 16;
-  for (i = 0; i < len && src < endp; i++)
+  for (i = 0; i < len && (src + i) < endp; i++)
     dstp[i] = src[i];
   dstp[i] = 0;
   *srcp = src + i;