Prevent an illegal memory access in gprof by ensuring that string tables for aout...

[deliverable/binutils-gdb.git] / bfd / aoutx.h

diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index fb1ac7db20629116a60b8e20faf44d9a2410f6d9..023843b0be42fa6ec4ade4f3a4111f437776fc63 100644 (file)
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -467,10 +467,7 @@ NAME (aout, some_aout_object_p) (bfd *abfd,
   oldrawptr = abfd->tdata.aout_data;
   abfd->tdata.aout_data = rawptr;
 
-  /* Copy the contents of the old tdata struct.
-     In particular, we want the subformat, since for hpux it was set in
-     hp300hpux.c:swap_exec_header_in and will be used in
-     hp300hpux.c:callback.  */
+  /* Copy the contents of the old tdata struct.  */
   if (oldrawptr != NULL)
     *abfd->tdata.aout_data = *oldrawptr;
 
@@ -751,17 +748,6 @@ NAME (aout, machine_type) (enum bfd_architecture arch,
        arch_flags = M_SPARCLET;
       break;
 
-    case bfd_arch_m68k:
-      switch (machine)
-       {
-       case 0:               arch_flags = M_68010; break;
-       case bfd_mach_m68000: arch_flags = M_UNKNOWN; *unknown = FALSE; break;
-       case bfd_mach_m68010: arch_flags = M_68010; break;
-       case bfd_mach_m68020: arch_flags = M_68020; break;
-       default:              arch_flags = M_UNKNOWN; break;
-       }
-      break;
-
     case bfd_arch_i386:
       if (machine == 0
          || machine == bfd_mach_i386_i386
@@ -840,10 +826,6 @@ NAME (aout, machine_type) (enum bfd_architecture arch,
        arch_flags = M_CRIS;
       break;
 
-    case bfd_arch_m88k:
-      *unknown = FALSE;
-      break;
-
     default:
       arch_flags = M_UNKNOWN;
     }
@@ -1361,7 +1343,7 @@ aout_get_external_symbols (bfd *abfd)
 #ifdef USE_MMAP
       if (stringsize >= BYTES_IN_WORD)
        {
-         if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
+         if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize + 1,
                                     &obj_aout_string_window (abfd), TRUE))
            return FALSE;
          strings = (char *) obj_aout_string_window (abfd).data;
@@ -1369,7 +1351,7 @@ aout_get_external_symbols (bfd *abfd)
       else
 #endif
        {
-         strings = (char *) bfd_malloc (stringsize);
+         strings = (char *) bfd_malloc (stringsize + 1);
          if (strings == NULL)
            return FALSE;
 
@@ -1388,7 +1370,8 @@ aout_get_external_symbols (bfd *abfd)
       /* Ensure that a zero index yields an empty string.  */
       strings[0] = '\0';
 
-      strings[stringsize - 1] = 0;
+      /* Ensure that the string buffer is NUL terminated.  */
+      strings[stringsize] = 0;
 
       obj_aout_external_strings (abfd) = strings;
       obj_aout_external_string_size (abfd) = stringsize;
@@ -2741,7 +2724,10 @@ NAME (aout, find_nearest_line) (bfd *abfd,
                  const char *symname;
 
                  symname = q->symbol.name;
-                 if (strcmp (symname + strlen (symname) - 2, ".o") == 0)
+
+                 if (symname != NULL
+                     && strlen (symname) > 2
+                     && strcmp (symname + strlen (symname) - 2, ".o") == 0)
                    {
                      if (q->symbol.value > low_line_vma)
                        {
@@ -2806,8 +2792,8 @@ NAME (aout, find_nearest_line) (bfd *abfd,
            case N_FUN:
              {
                /* We'll keep this if it is nearer than the one we have already.  */
-               if (q->symbol.value >= low_func_vma &&
-                   q->symbol.value <= offset)
+               if (q->symbol.value >= low_func_vma
+                   && q->symbol.value <= offset)
                  {
                    low_func_vma = q->symbol.value;
                    func = (asymbol *)q;
@@ -5501,8 +5487,7 @@ NAME (aout, final_link) (bfd *abfd,
      FIXME: At this point we do not know how much space the symbol
      table will require.  This will not work for any (nonstandard)
      a.out target that needs to know the symbol table size before it
-     can compute the relocation file positions.  This may or may not
-     be the case for the hp300hpux target, for example.  */
+     can compute the relocation file positions.  */
   (*callback) (abfd, &aout_info.treloff, &aout_info.dreloff,
               &aout_info.symoff);
   obj_textsec (abfd)->rel_filepos = aout_info.treloff;