Fix memory access problems exposed by fuzzed binaries.

[deliverable/binutils-gdb.git] / bfd / archive64.c

diff --git a/bfd/archive64.c b/bfd/archive64.c
index bbc4c3f72f9e0acb4b01eb36fae31cb21dd79dfc..6b87ec520283b831175c19602f3c305dbdc1b3dc 100644 (file)
--- a/bfd/archive64.c
+++ b/bfd/archive64.c
@@ -1,6 +1,5 @@
-/* MIPS-specific support for 64-bit ELF
-   Copyright 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2005, 2006, 2007,
-   2010  Free Software Foundation, Inc.
+/* Support for 64-bit ELF archives.
+   Copyright (C) 1996-2014 Free Software Foundation, Inc.
    Ian Lance Taylor, Cygnus Support
    Linker support added by Mark Mitchell, CodeSourcery, LLC.
    <mark@codesourcery.com>
@@ -77,7 +76,7 @@ bfd_elf64_archive_slurp_armap (bfd *abfd)
   if (mapdata == NULL)
     return FALSE;
   parsed_size = mapdata->parsed_size;
-  bfd_release (abfd, mapdata);
+  free (mapdata);
 
   if (bfd_bread (int_buf, 8, abfd) != 8)
     {
@@ -169,8 +168,8 @@ bfd_elf64_archive_write_armap (bfd *arch,
 
   memset (&hdr, ' ', sizeof (struct ar_hdr));
   memcpy (hdr.ar_name, "/SYM64/", strlen ("/SYM64/"));
-  _bfd_ar_spacepad (hdr.ar_size, sizeof (hdr.ar_size), "%-10ld",
-                    mapsize);
+  if (!_bfd_ar_sizepad (hdr.ar_size, sizeof (hdr.ar_size), mapsize))
+    return FALSE;
   _bfd_ar_spacepad (hdr.ar_date, sizeof (hdr.ar_date), "%ld",
                     time (NULL));
   /* This, at least, is what Intel coff sets the values to.: */
@@ -200,7 +199,7 @@ bfd_elf64_archive_write_armap (bfd *arch,
        current = current->archive_next)
     {
       /* For each symbol which is used defined in this object, write out
-        the object file's address in the archive */
+        the object file's address in the archive.  */
 
       for (;
           count < symbol_count && map[count].u.abfd == current;
@@ -210,9 +209,11 @@ bfd_elf64_archive_write_armap (bfd *arch,
          if (bfd_bwrite (buf, 8, arch) != 8)
            return FALSE;
        }
+
       /* Add size of this archive entry */
-      archive_member_file_ptr += (arelt_size (current)
-                                 + sizeof (struct ar_hdr));
+      archive_member_file_ptr += sizeof (struct ar_hdr);
+      if (! bfd_is_thin_archive (arch))
+       archive_member_file_ptr += arelt_size (current);
       /* remember about the even alignment */
       archive_member_file_ptr += archive_member_file_ptr % 2;
     }