From: Alan Modra <amodra@gmail.com>
Date: Fri, 17 Mar 2023 10:39:31 +0000 (+1030)
Subject: ctf segfaults
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=027333da75744bd27e6f05e58ac625f5bf450c8a;p=binutils-gdb.git

ctf segfaults

	PR 30228
	PR 30229
	* ctf-open.c (ctf_bufopen_internal): Check for NULL cts_data.
	* ctf-archive.c (ctf_arc_bufpreamble, ctf_arc_bufopen): Likewise.
---

diff --git a/libctf/ctf-archive.c b/libctf/ctf-archive.c
index abae90da113..54c49b3edbb 100644
--- a/libctf/ctf-archive.c
+++ b/libctf/ctf-archive.c
@@ -402,8 +402,9 @@ ctf_arc_symsect_endianness (ctf_archive_t *arc, int little_endian)
 const ctf_preamble_t *
 ctf_arc_bufpreamble (const ctf_sect_t *ctfsect)
 {
-  if (ctfsect->cts_size > sizeof (uint64_t) &&
-      (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
+  if (ctfsect->cts_data != NULL
+      && ctfsect->cts_size > sizeof (uint64_t)
+      && (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
     {
       struct ctf_archive *arc = (struct ctf_archive *) ctfsect->cts_data;
       return (const ctf_preamble_t *) ((char *) arc + le64toh (arc->ctfa_ctfs)
@@ -424,8 +425,9 @@ ctf_arc_bufopen (const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
   int is_archive;
   ctf_dict_t *fp = NULL;
 
-  if (ctfsect->cts_size > sizeof (uint64_t) &&
-      (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
+  if (ctfsect->cts_data != NULL
+      && ctfsect->cts_size > sizeof (uint64_t)
+      && (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
     {
       /* The archive is mmappable, so this operation is trivial.
 
diff --git a/libctf/ctf-open.c b/libctf/ctf-open.c
index 5bcf0dd9b76..35f635b6559 100644
--- a/libctf/ctf-open.c
+++ b/libctf/ctf-open.c
@@ -1354,7 +1354,8 @@ ctf_bufopen_internal (const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
   if (strsect != NULL && strsect->cts_data == NULL)
     return (ctf_set_open_errno (errp, ECTF_STRBAD));
 
-  if (ctfsect->cts_size < sizeof (ctf_preamble_t))
+  if (ctfsect->cts_data == NULL
+      || ctfsect->cts_size < sizeof (ctf_preamble_t))
     return (ctf_set_open_errno (errp, ECTF_NOCTFBUF));
 
   pp = (const ctf_preamble_t *) ctfsect->cts_data;