ubsan: m10300: shift exponent -4

[deliverable/binutils-gdb.git] / bfd / coff-rs6000.c

diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c
index bdbb499a4ab245170b47668fedb386485849bfb5..e14db6f4891114bccfb1a312353fc889e1cf3baf 100644 (file)
--- a/bfd/coff-rs6000.c
+++ b/bfd/coff-rs6000.c
@@ -1,5 +1,5 @@
 /* BFD back-end for IBM RS/6000 "XCOFF" files.
-   Copyright (C) 1990-2019 Free Software Foundation, Inc.
+   Copyright (C) 1990-2020 Free Software Foundation, Inc.
    Written by Metin G. Ozisik, Mimi Phuong-Thao Vo, and John Gilmore.
    Archive support from Damon A. Permezel.
    Contributed by IBM Corporation and Cygnus Support.
@@ -1169,20 +1169,6 @@ _bfd_xcoff_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED,
    to take care that we are not generating the new form of archives
    on AIX 4.2 or earlier systems.  */
 
-/* XCOFF archives use this as a magic string.  Note that both strings
-   have the same length.  */
-
-/* Set the magic for archive.  */
-
-bfd_boolean
-bfd_xcoff_ar_archive_set_magic (bfd *abfd ATTRIBUTE_UNUSED,
-                               char *magic ATTRIBUTE_UNUSED)
-{
-  /* Not supported yet.  */
-  return FALSE;
- /* bfd_xcoff_archive_set_magic (abfd, magic); */
-}
-
 /* PR 21786:  The PE/COFF standard does not require NUL termination for any of
    the ASCII fields in the archive headers.  So in order to be able to extract
    numerical values we provide our own versions of strtol and strtoll which
@@ -1274,18 +1260,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
        return FALSE;
 
       GET_VALUE_IN_FIELD (sz, hdr.size, 10);
+      if (sz == (bfd_size_type) -1)
+       {
+         bfd_set_error (bfd_error_no_memory);
+         return FALSE;
+       }
 
       /* Read in the entire symbol table.  */
-      contents = (bfd_byte *) bfd_alloc (abfd, sz);
+      contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
       if (contents == NULL)
        return FALSE;
       if (bfd_bread (contents, sz, abfd) != sz)
        return FALSE;
 
+      /* Ensure strings are NULL terminated so we don't wander off the
+        end of the buffer.  */
+      contents[sz] = 0;
+
       /* The symbol table starts with a four byte count.  */
       c = H_GET_32 (abfd, contents);
 
-      if (c * 4 >= sz)
+      if (c >= sz / 4)
        {
          bfd_set_error (bfd_error_bad_value);
          return FALSE;
@@ -1329,18 +1324,27 @@ _bfd_xcoff_slurp_armap (bfd *abfd)
        return FALSE;
 
       GET_VALUE_IN_FIELD (sz, hdr.size, 10);
+      if (sz == (bfd_size_type) -1)
+       {
+         bfd_set_error (bfd_error_no_memory);
+         return FALSE;
+       }
 
       /* Read in the entire symbol table.  */
-      contents = (bfd_byte *) bfd_alloc (abfd, sz);
+      contents = (bfd_byte *) bfd_alloc (abfd, sz + 1);
       if (contents == NULL)
        return FALSE;
       if (bfd_bread (contents, sz, abfd) != sz)
        return FALSE;
 
+      /* Ensure strings are NULL terminated so we don't wander off the
+        end of the buffer.  */
+      contents[sz] = 0;
+
       /* The symbol table starts with an eight byte count.  */
       c = H_GET_64 (abfd, contents);
 
-      if (c * 8 >= sz)
+      if (c >= sz / 8)
        {
          bfd_set_error (bfd_error_bad_value);
          return FALSE;