From: Nick Clifton <nickc@redhat.com>
Date: Mon, 5 Dec 2016 16:00:43 +0000 (+0000)
Subject: Fix seg-fault in linker when passed a bogus input script.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=406bd128dba2a59d0736839fc87a59bce319076c;p=binutils-gdb.git

Fix seg-fault in linker when passed a bogus input script.

	PR ld/20906
	* ldlex.l: Check for bogus strings in linker scripts.
---

diff --git a/ld/ChangeLog b/ld/ChangeLog
index 3529834b013..19e94e9088f 100644
--- a/ld/ChangeLog
+++ b/ld/ChangeLog
@@ -1,3 +1,8 @@
+2016-12-05  Nick Clifton  <nickc@redhat.com>
+
+	PR ld/20906
+	* ldlex.l: Check for bogus strings in linker scripts.
+
 2016-12-05  Alyssa Milburn <amilburn@zall.org>
 
 	* testsuite/ld-sparc/wdispcall.s: New file.
diff --git a/ld/ldlex.l b/ld/ldlex.l
index e1394a03576..cd21c58e3dd 100644
--- a/ld/ldlex.l
+++ b/ld/ldlex.l
@@ -415,9 +415,15 @@ V_IDENTIFIER [*?.$_a-zA-Z\[\]\-\!\^\\]([*?.$_a-zA-Z0-9\[\]\-\!\^\\]|::)*
 
 <EXPRESSION,BOTH,SCRIPT,VERS_NODE,INPUTLIST>"\""[^\"]*"\"" {
 					/* No matter the state, quotes
-					   give what's inside */
+					   give what's inside.  */
+					bfd_size_type len;
 					yylval.name = xstrdup (yytext + 1);
-					yylval.name[yyleng - 2] = 0;
+					/* PR ld/20906.  A corrupt input file
+					   can contain bogus strings.  */
+					len = strlen (yylval.name);
+					if (len > yyleng - 2)
+					  len = yyleng - 2;
+					yylval.name[len] = 0;
 					return NAME;
 				}
 <BOTH,SCRIPT,EXPRESSION>"\n"		{ lineno++;}