Fix memory access problems exposed by fuzzed binaries.

[deliverable/binutils-gdb.git] / bfd / archive64.c

diff --git a/bfd/archive64.c b/bfd/archive64.c
index 5e2bf1198c2072819188ca7113c5814fb2255412..6b87ec520283b831175c19602f3c305dbdc1b3dc 100644 (file)
--- a/bfd/archive64.c
+++ b/bfd/archive64.c
@@ -1,6 +1,5 @@
-/* MIPS-specific support for 64-bit ELF
-   Copyright 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2006, 2007
-   Free Software Foundation, Inc.
+/* Support for 64-bit ELF archives.
+   Copyright (C) 1996-2014 Free Software Foundation, Inc.
    Ian Lance Taylor, Cygnus Support
    Linker support added by Mark Mitchell, CodeSourcery, LLC.
    <mark@codesourcery.com>
@@ -9,7 +8,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
@@ -19,7 +18,8 @@
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston,
+   MA 02110-1301, USA.  */
 
 /* This file supports the 64-bit (MIPS) ELF archives.  */
 
@@ -42,7 +42,6 @@ bfd_elf64_archive_slurp_armap (bfd *abfd)
 {
   struct artdata *ardata = bfd_ardata (abfd);
   char nextname[17];
-  file_ptr arhdrpos;
   bfd_size_type i, parsed_size, nsymz, stringsize, carsym_size, ptrsize;
   struct areltdata *mapdata;
   bfd_byte int_buf[8];
@@ -54,7 +53,6 @@ bfd_elf64_archive_slurp_armap (bfd *abfd)
   ardata->symdefs = NULL;
 
   /* Get the name of the first element.  */
-  arhdrpos = bfd_tell (abfd);
   i = bfd_bread (nextname, 16, abfd);
   if (i == 0)
     return TRUE;
@@ -78,7 +76,7 @@ bfd_elf64_archive_slurp_armap (bfd *abfd)
   if (mapdata == NULL)
     return FALSE;
   parsed_size = mapdata->parsed_size;
-  bfd_release (abfd, mapdata);
+  free (mapdata);
 
   if (bfd_bread (int_buf, 8, abfd) != 8)
     {
@@ -94,13 +92,13 @@ bfd_elf64_archive_slurp_armap (bfd *abfd)
   ptrsize = 8 * nsymz;
 
   amt = carsym_size + stringsize + 1;
-  ardata->symdefs = bfd_zalloc (abfd, amt);
+  ardata->symdefs = (struct carsym *) bfd_zalloc (abfd, amt);
   if (ardata->symdefs == NULL)
     return FALSE;
   carsyms = ardata->symdefs;
   stringbase = ((char *) ardata->symdefs) + carsym_size;
 
-  raw_armap = bfd_alloc (abfd, ptrsize);
+  raw_armap = (bfd_byte *) bfd_alloc (abfd, ptrsize);
   if (raw_armap == NULL)
     goto release_symdefs;
 
@@ -170,8 +168,8 @@ bfd_elf64_archive_write_armap (bfd *arch,
 
   memset (&hdr, ' ', sizeof (struct ar_hdr));
   memcpy (hdr.ar_name, "/SYM64/", strlen ("/SYM64/"));
-  _bfd_ar_spacepad (hdr.ar_size, sizeof (hdr.ar_size), "%-10ld",
-                    mapsize);
+  if (!_bfd_ar_sizepad (hdr.ar_size, sizeof (hdr.ar_size), mapsize))
+    return FALSE;
   _bfd_ar_spacepad (hdr.ar_date, sizeof (hdr.ar_date), "%ld",
                     time (NULL));
   /* This, at least, is what Intel coff sets the values to.: */
@@ -195,27 +193,29 @@ bfd_elf64_archive_write_armap (bfd *arch,
 
   /* Write out the file offset for the file associated with each
      symbol, and remember to keep the offsets padded out.  */
-
-  current = arch->archive_head;
   count = 0;
-  while (current != NULL && count < symbol_count)
+  for (current = arch->archive_head;
+       current != NULL && count < symbol_count;
+       current = current->archive_next)
     {
       /* For each symbol which is used defined in this object, write out
-        the object file's address in the archive */
+        the object file's address in the archive.  */
 
-      while (map[count].u.abfd == current)
+      for (;
+          count < symbol_count && map[count].u.abfd == current;
+          count++)
        {
          bfd_putb64 ((bfd_vma) archive_member_file_ptr, buf);
          if (bfd_bwrite (buf, 8, arch) != 8)
            return FALSE;
-         count++;
        }
+
       /* Add size of this archive entry */
-      archive_member_file_ptr += (arelt_size (current)
-                                 + sizeof (struct ar_hdr));
+      archive_member_file_ptr += sizeof (struct ar_hdr);
+      if (! bfd_is_thin_archive (arch))
+       archive_member_file_ptr += arelt_size (current);
       /* remember about the even alignment */
       archive_member_file_ptr += archive_member_file_ptr % 2;
-      current = current->archive_next;
     }
 
   /* now write the strings themselves */