Prevent an illegal memory access in gprof by ensuring that string tables for aout...

[deliverable/binutils-gdb.git] / bfd / aoutx.h

diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index 0e0bab087582aa6714aa1b211b61f92cef920814..023843b0be42fa6ec4ade4f3a4111f437776fc63 100644 (file)
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -1343,7 +1343,7 @@ aout_get_external_symbols (bfd *abfd)
 #ifdef USE_MMAP
       if (stringsize >= BYTES_IN_WORD)
        {
-         if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
+         if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize + 1,
                                     &obj_aout_string_window (abfd), TRUE))
            return FALSE;
          strings = (char *) obj_aout_string_window (abfd).data;
@@ -1351,7 +1351,7 @@ aout_get_external_symbols (bfd *abfd)
       else
 #endif
        {
-         strings = (char *) bfd_malloc (stringsize);
+         strings = (char *) bfd_malloc (stringsize + 1);
          if (strings == NULL)
            return FALSE;
 
@@ -1370,7 +1370,8 @@ aout_get_external_symbols (bfd *abfd)
       /* Ensure that a zero index yields an empty string.  */
       strings[0] = '\0';
 
-      strings[stringsize - 1] = 0;
+      /* Ensure that the string buffer is NUL terminated.  */
+      strings[stringsize] = 0;
 
       obj_aout_external_strings (abfd) = strings;
       obj_aout_external_string_size (abfd) = stringsize;
@@ -2723,7 +2724,10 @@ NAME (aout, find_nearest_line) (bfd *abfd,
                  const char *symname;
 
                  symname = q->symbol.name;
-                 if (strcmp (symname + strlen (symname) - 2, ".o") == 0)
+
+                 if (symname != NULL
+                     && strlen (symname) > 2
+                     && strcmp (symname + strlen (symname) - 2, ".o") == 0)
                    {
                      if (q->symbol.value > low_line_vma)
                        {
@@ -2788,8 +2792,8 @@ NAME (aout, find_nearest_line) (bfd *abfd,
            case N_FUN:
              {
                /* We'll keep this if it is nearer than the one we have already.  */
-               if (q->symbol.value >= low_func_vma &&
-                   q->symbol.value <= offset)
+               if (q->symbol.value >= low_func_vma
+                   && q->symbol.value <= offset)
                  {
                    low_func_vma = q->symbol.value;
                    func = (asymbol *)q;