From: Nick Clifton <nickc@redhat.com>
Date: Thu, 10 Aug 2017 10:51:42 +0000 (+0100)
Subject: Fix memory corruption when assembling an i386 darwin source file.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=4c2da80c2bdff7761eb5b3d9c03ffa0c9958b6b9;p=binutils-gdb.git

Fix memory corruption when assembling an i386 darwin source file.

	PR gas/21939
	* config/obj-macho.c (obj_mach_o_set_indirect_symbols): Increase
	size of indirect_syms array so that it is large enough to hold
	every symbol if necessary.
---

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 3edb1795a67..adeb38bb27a 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2017-08-10  Nick Clifton  <nickc@redhat.com>
+
+	PR gas/21939
+	* config/obj-macho.c (obj_mach_o_set_indirect_symbols): Increase
+	size of indirect_syms array so that it is large enough to hold
+	every symbol if necessary.
+
 2017-08-09  Jiong Wang  <jiong.wang@arm.com>
 
 	* config/tc-arm.c (do_crc32_1): Remove warning on REG_SP for thumb_mode.
diff --git a/gas/config/obj-macho.c b/gas/config/obj-macho.c
index 28867bd3eeb..8cc9581cbbe 100644
--- a/gas/config/obj-macho.c
+++ b/gas/config/obj-macho.c
@@ -1808,15 +1808,21 @@ obj_mach_o_set_indirect_symbols (bfd *abfd, asection *sec,
 	    {
 	      unsigned n;
 	      bfd_mach_o_asymbol *sym;
+
+	      /* FIXME: It seems that there can be more indirect symbols
+		 than is computed by the loop above.  So be paranoid and
+		 allocate enough space for every symbol to be indirect.
+		 See PR 21939 for an example of where this is needed.  */
+	      if (nactual < bfd_get_symcount (abfd))
+		nactual = bfd_get_symcount (abfd);
+
 	      ms->indirect_syms =
 			bfd_zalloc (abfd,
 				    nactual * sizeof (bfd_mach_o_asymbol *));
 
 	      if (ms->indirect_syms == NULL)
-		{
-		  as_fatal (_("internal error: failed to allocate %d indirect"
-			      "symbol pointers"), nactual);
-		}
+		as_fatal (_("internal error: failed to allocate %d indirect"
+			    "symbol pointers"), nactual);
 
 	      for (isym = list, n = 0; isym != NULL; isym = isym->next, n++)
 		{
@@ -1827,7 +1833,11 @@ obj_mach_o_set_indirect_symbols (bfd *abfd, asection *sec,
 
 		     Absolute symbols are handled specially.  */
 		  if (sym->symbol.section == bfd_abs_section_ptr)
-		    ms->indirect_syms[n] = sym;
+		    {
+		      if (n >= nactual)
+			as_fatal (_("internal error: more indirect mach-o symbols than expected"));
+		      ms->indirect_syms[n] = sym;
+		    }
 		  else if (S_IS_LOCAL (isym->sym) && ! lazy)
 		    ;
 		  else
@@ -1847,6 +1857,8 @@ obj_mach_o_set_indirect_symbols (bfd *abfd, asection *sec,
 			      && ! (sym->n_type & BFD_MACH_O_N_PEXT)
 			      && (sym->n_type & BFD_MACH_O_N_EXT))
 			    sym->n_desc |= lazy;
+			  if (n >= nactual)
+			    as_fatal (_("internal error: more indirect mach-o symbols than expected"));
 			  ms->indirect_syms[n] = sym;
 		        }
 		    }