Fix an assertion failure in the BFD library when parsing a corrupt SREC format file.

	PR 27759
	* srec.c (srec_read_section): Replace assertions with error
	returns.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 972311bce482da3a013044e848b1e4a6df2408cd..85f4f37de1e99c43ce0b38560f1b836d3aa85f13 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2021-04-21  Nick Clifton  <nickc@redhat.com>
+
+       PR 27759
+       * srec.c (srec_read_section): Replace assertions with error
+       returns.
+
 2021-04-20  Clément Chigot  <clement.chigot@atos.net>
 
        PR binutils/21700

diff --git a/bfd/srec.c b/bfd/srec.c
index 3ddb3c56e33c2fae3fb6dcc144ca1bdeb565c42d..9628691ad8f39832c5f6c1a710b7addb72e935c9 100644 (file)
--- a/bfd/srec.c
+++ b/bfd/srec.c
@@ -733,7 +733,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
 
       /* This is called after srec_scan has already been called, so we
         ought to know the exact format.  */
-      BFD_ASSERT (c == 'S');
+      if (c != 'S')
+       goto error_return;
 
       if (bfd_bread (hdr, (bfd_size_type) 3, abfd) != 3)
        goto error_return;
@@ -759,7 +760,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
       switch (hdr[0])
        {
        default:
-         BFD_ASSERT (sofar == section->size);
+         if (sofar != section->size)
+           goto error_return;
          free (buf);
          return true;
 
@@ -783,7 +785,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
          if (address != section->vma + sofar)
            {
              /* We've come to the end of this section.  */
-             BFD_ASSERT (sofar == section->size);
+             if (sofar != section->size)
+               goto error_return;
              free (buf);
              return true;
            }
@@ -805,7 +808,8 @@ srec_read_section (bfd *abfd, asection *section, bfd_byte *contents)
   if (error)
     goto error_return;
 
-  BFD_ASSERT (sofar == section->size);
+  if (sofar != section->size)
+    goto error_return;
 
   free (buf);
   return true;