Fix address violation parsing a corrupt SOM binary.

[deliverable/binutils-gdb.git] / bfd / som.c

diff --git a/bfd/som.c b/bfd/som.c
index 496040c3f0faa2fed2b9180ee5b136a1ee6e787d..98c4124bbadd0c4c39a015cb7185db8b54d61937 100644 (file)
--- a/bfd/som.c
+++ b/bfd/som.c
@@ -2083,8 +2083,8 @@ setup_sections (bfd *abfd,
 
   /* First, read in space names.  */
   amt = file_hdr->space_strings_size;
-  space_strings = bfd_malloc (amt);
-  if (!space_strings && amt != 0)
+  space_strings = bfd_malloc (amt + 1);
+  if (space_strings == NULL && amt != 0)
     goto error_return;
 
   if (bfd_seek (abfd, current_offset + file_hdr->space_strings_location,
@@ -2092,6 +2092,8 @@ setup_sections (bfd *abfd,
     goto error_return;
   if (bfd_bread (space_strings, amt, abfd) != amt)
     goto error_return;
+  /* Make sure that the string table is NUL terminated.  */
+  space_strings[amt] = 0;
 
   /* Loop over all of the space dictionaries, building up sections.  */
   for (space_index = 0; space_index < file_hdr->space_total; space_index++)
@@ -2119,6 +2121,9 @@ setup_sections (bfd *abfd,
       som_swap_space_dictionary_in (&ext_space, &space);
 
       /* Setup the space name string.  */
+      if (space.name >= file_hdr->space_strings_size)
+       goto error_return;
+
       space_name = space.name + space_strings;
 
       /* Make a section out of it.  */
@@ -6754,6 +6759,7 @@ som_bfd_link_split_section (bfd *abfd ATTRIBUTE_UNUSED, asection *sec)
 #define som_bfd_discard_group                  bfd_generic_discard_group
 #define som_section_already_linked              _bfd_generic_section_already_linked
 #define som_bfd_define_common_symbol            bfd_generic_define_common_symbol
+#define som_bfd_define_start_stop               bfd_generic_define_start_stop
 #define som_bfd_merge_private_bfd_data         _bfd_generic_bfd_merge_private_bfd_data
 #define som_bfd_copy_private_header_data       _bfd_generic_bfd_copy_private_header_data
 #define som_bfd_set_private_flags              _bfd_generic_bfd_set_private_flags