readelf leak in process_archive
[deliverable/binutils-gdb.git] / binutils / readelf.c
index b106e8c816f7daa50ca502a91edf6bb31cbbb64b..f76b9f6d8e6baa98d5888893c18e912093af4b8c 100644 (file)
@@ -6765,6 +6765,47 @@ process_section_headers (Filedata * filedata)
   return TRUE;
 }
 
+static bfd_boolean
+get_symtab (Filedata *filedata, Elf_Internal_Shdr *symsec,
+           Elf_Internal_Sym **symtab, unsigned long *nsyms,
+           char **strtab, unsigned long *strtablen)
+{
+  *strtab = NULL;
+  *strtablen = 0;
+  *symtab = GET_ELF_SYMBOLS (filedata, symsec, nsyms);
+
+  if (*symtab == NULL)
+    return FALSE;
+
+  if (symsec->sh_link != 0)
+    {
+      Elf_Internal_Shdr *strsec;
+
+      if (symsec->sh_link >= filedata->file_header.e_shnum)
+       {
+         error (_("Bad sh_link in symbol table section\n"));
+         free (*symtab);
+         *symtab = NULL;
+         *nsyms = 0;
+         return FALSE;
+       }
+
+      strsec = filedata->section_headers + symsec->sh_link;
+
+      *strtab = (char *) get_data (NULL, filedata, strsec->sh_offset,
+                                  1, strsec->sh_size, _("string table"));
+      if (*strtab == NULL)
+       {
+         free (*symtab);
+         *symtab = NULL;
+         *nsyms = 0;
+         return FALSE;
+       }
+      *strtablen = strsec->sh_size;
+    }
+  return TRUE;
+}
+
 static const char *
 get_group_flags (unsigned int flags)
 {
@@ -7355,7 +7396,6 @@ process_relocs (Filedata * filedata)
 
          if (rel_size)
            {
-             Elf_Internal_Shdr * strsec;
              int is_rela;
              unsigned long num_rela;
 
@@ -7388,22 +7428,10 @@ process_relocs (Filedata * filedata)
                      && symsec->sh_type != SHT_DYNSYM)
                     continue;
 
-                 symtab = GET_ELF_SYMBOLS (filedata, symsec, & nsyms);
-
-                 if (symtab == NULL)
+                 if (!get_symtab (filedata, symsec,
+                                  &symtab, &nsyms, &strtab, &strtablen))
                    continue;
 
-                 if (symsec->sh_link != 0
-                     && symsec->sh_link < filedata->file_header.e_shnum)
-                   {
-                     strsec = filedata->section_headers + symsec->sh_link;
-
-                     strtab = (char *) get_data (NULL, filedata, strsec->sh_offset,
-                                                 1, strsec->sh_size,
-                                                 _("string table"));
-                     strtablen = strtab == NULL ? 0 : strsec->sh_size;
-                   }
-
                  dump_relocations (filedata, rel_offset, rel_size,
                                    symtab, nsyms, strtab, strtablen,
                                    is_rela,
@@ -7804,7 +7832,6 @@ ia64_process_unwind (Filedata * filedata)
 {
   Elf_Internal_Shdr * sec;
   Elf_Internal_Shdr * unwsec = NULL;
-  Elf_Internal_Shdr * strsec;
   unsigned long i, unwcount = 0, unwstart = 0;
   struct ia64_unw_aux_info aux;
   bfd_boolean res = TRUE;
@@ -7813,22 +7840,19 @@ ia64_process_unwind (Filedata * filedata)
 
   for (i = 0, sec = filedata->section_headers; i < filedata->file_header.e_shnum; ++i, ++sec)
     {
-      if (sec->sh_type == SHT_SYMTAB
-         && sec->sh_link < filedata->file_header.e_shnum)
+      if (sec->sh_type == SHT_SYMTAB)
        {
-         aux.symtab = GET_ELF_SYMBOLS (filedata, sec, & aux.nsyms);
-
-         strsec = filedata->section_headers + sec->sh_link;
-         if (aux.strtab != NULL)
+         if (aux.symtab)
            {
-             error (_("Multiple auxillary string tables encountered\n"));
+             error (_("Multiple symbol tables encountered\n"));
+             free (aux.symtab);
+             aux.symtab = NULL;
              free (aux.strtab);
-             res = FALSE;
+             aux.strtab = NULL;
            }
-         aux.strtab = (char *) get_data (NULL, filedata, strsec->sh_offset,
-                                          1, strsec->sh_size,
-                                          _("string table"));
-         aux.strtab_size = aux.strtab != NULL ? strsec->sh_size : 0;
+         if (!get_symtab (filedata, sec, &aux.symtab, &aux.nsyms,
+                          &aux.strtab, &aux.strtab_size))
+           return FALSE;
        }
       else if (sec->sh_type == SHT_IA_64_UNWIND)
        unwcount++;
@@ -8265,7 +8289,6 @@ hppa_process_unwind (Filedata * filedata)
 {
   struct hppa_unw_aux_info aux;
   Elf_Internal_Shdr * unwsec = NULL;
-  Elf_Internal_Shdr * strsec;
   Elf_Internal_Shdr * sec;
   unsigned long i;
   bfd_boolean res = TRUE;
@@ -8277,22 +8300,19 @@ hppa_process_unwind (Filedata * filedata)
 
   for (i = 0, sec = filedata->section_headers; i < filedata->file_header.e_shnum; ++i, ++sec)
     {
-      if (sec->sh_type == SHT_SYMTAB
-         && sec->sh_link < filedata->file_header.e_shnum)
+      if (sec->sh_type == SHT_SYMTAB)
        {
-         aux.symtab = GET_ELF_SYMBOLS (filedata, sec, & aux.nsyms);
-
-         strsec = filedata->section_headers + sec->sh_link;
-         if (aux.strtab != NULL)
+         if (aux.symtab)
            {
-             error (_("Multiple auxillary string tables encountered\n"));
+             error (_("Multiple symbol tables encountered\n"));
+             free (aux.symtab);
+             aux.symtab = NULL;
              free (aux.strtab);
-             res = FALSE;
+             aux.strtab = NULL;
            }
-         aux.strtab = (char *) get_data (NULL, filedata, strsec->sh_offset,
-                                          1, strsec->sh_size,
-                                          _("string table"));
-         aux.strtab_size = aux.strtab != NULL ? strsec->sh_size : 0;
+         if (!get_symtab (filedata, sec, &aux.symtab, &aux.nsyms,
+                          &aux.strtab, &aux.strtab_size))
+           return FALSE;
        }
       else if (streq (SECTION_NAME (sec), ".PARISC.unwind"))
        unwsec = sec;
@@ -9363,7 +9383,6 @@ arm_process_unwind (Filedata * filedata)
 {
   struct arm_unw_aux_info aux;
   Elf_Internal_Shdr *unwsec = NULL;
-  Elf_Internal_Shdr *strsec;
   Elf_Internal_Shdr *sec;
   unsigned long i;
   unsigned int sec_type;
@@ -9393,22 +9412,19 @@ arm_process_unwind (Filedata * filedata)
 
   for (i = 0, sec = filedata->section_headers; i < filedata->file_header.e_shnum; ++i, ++sec)
     {
-      if (sec->sh_type == SHT_SYMTAB && sec->sh_link < filedata->file_header.e_shnum)
+      if (sec->sh_type == SHT_SYMTAB)
        {
-         aux.symtab = GET_ELF_SYMBOLS (filedata, sec, & aux.nsyms);
-
-         strsec = filedata->section_headers + sec->sh_link;
-
-         /* PR binutils/17531 file: 011-12666-0.004.  */
-         if (aux.strtab != NULL)
+         if (aux.symtab)
            {
-             error (_("Multiple string tables found in file.\n"));
+             error (_("Multiple symbol tables encountered\n"));
+             free (aux.symtab);
+             aux.symtab = NULL;
              free (aux.strtab);
-             res = FALSE;
+             aux.strtab = NULL;
            }
-         aux.strtab = get_data (NULL, filedata, strsec->sh_offset,
-                                1, strsec->sh_size, _("string table"));
-         aux.strtab_size = aux.strtab != NULL ? strsec->sh_size : 0;
+         if (!get_symtab (filedata, sec, &aux.symtab, &aux.nsyms,
+                          &aux.strtab, &aux.strtab_size))
+           return FALSE;
        }
       else if (sec->sh_type == sec_type)
        unwsec = sec;
@@ -18386,15 +18402,17 @@ process_netbsd_elf_note (Elf_Internal_Note * pnote)
   switch (pnote->type)
     {
     case NT_NETBSD_IDENT:
+      if (pnote->descsz < 1)
+       break;
       version = byte_get ((unsigned char *) pnote->descdata, sizeof (version));
       if ((version / 10000) % 100)
-        printf ("  NetBSD\t\t0x%08lx\tIDENT %u (%u.%u%s%c)\n", pnote->descsz,
+       printf ("  NetBSD\t\t0x%08lx\tIDENT %u (%u.%u%s%c)\n", pnote->descsz,
                version, version / 100000000, (version / 1000000) % 100,
                (version / 10000) % 100 > 26 ? "Z" : "",
                'A' + (version / 10000) % 26);
       else
        printf ("  NetBSD\t\t0x%08lx\tIDENT %u (%u.%u.%u)\n", pnote->descsz,
-               version, version / 100000000, (version / 1000000) % 100,
+               version, version / 100000000, (version / 1000000) % 100,
                (version / 100) % 100);
       return TRUE;
 
@@ -18405,6 +18423,8 @@ process_netbsd_elf_note (Elf_Internal_Note * pnote)
 
 #ifdef   NT_NETBSD_PAX
     case NT_NETBSD_PAX:
+      if (pnote->descsz < 1)
+       break;
       version = byte_get ((unsigned char *) pnote->descdata, sizeof (version));
       printf ("  NetBSD\t\t0x%08lx\tPaX <%s%s%s%s%s%s>\n", pnote->descsz,
              ((version & NT_NETBSD_PAX_MPROTECT) ? "+mprotect" : ""),
@@ -18415,12 +18435,11 @@ process_netbsd_elf_note (Elf_Internal_Note * pnote)
              ((version & NT_NETBSD_PAX_NOASLR) ? "-ASLR" : ""));
       return TRUE;
 #endif
-
-    default:
-      printf ("  NetBSD\t0x%08lx\tUnknown note type: (0x%08lx)\n", pnote->descsz,
-             pnote->type);
-      return FALSE;
     }
+
+  printf ("  NetBSD\t0x%08lx\tUnknown note type: (0x%08lx)\n",
+         pnote->descsz, pnote->type);
+  return FALSE;
 }
 
 static const char *
@@ -18836,31 +18855,11 @@ get_symbol_for_build_attribute (Filedata *       filedata,
           symsec < filedata->section_headers + filedata->file_header.e_shnum;
           symsec ++)
        {
-         if (symsec->sh_type == SHT_SYMTAB)
-           {
-             ba_cache.symtab = GET_ELF_SYMBOLS (filedata, symsec,
-                                                &ba_cache.nsyms);
-
-             if (ba_cache.symtab != NULL
-                 && symsec->sh_link < filedata->file_header.e_shnum)
-               {
-                 Elf_Internal_Shdr *strtab_sec
-                   = filedata->section_headers + symsec->sh_link;
-
-                 ba_cache.strtab
-                   = (char *) get_data (NULL, filedata, strtab_sec->sh_offset,
-                                        1, strtab_sec->sh_size,
-                                        _("string table"));
-                 ba_cache.strtablen = strtab_sec->sh_size;
-               }
-             if (ba_cache.strtab == NULL)
-               {
-                 free (ba_cache.symtab);
-                 ba_cache.symtab = NULL;
-               }
-             if (ba_cache.symtab != NULL)
-               break;
-           }
+         if (symsec->sh_type == SHT_SYMTAB
+             && get_symtab (filedata, symsec,
+                            &ba_cache.symtab, &ba_cache.nsyms,
+                            &ba_cache.strtab, &ba_cache.strtablen))
+           break;
        }
       ba_cache.filedata = filedata;
     }
@@ -20247,7 +20246,8 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
   nested_arch.longnames = NULL;
 
   if (setup_archive (&arch, filedata->file_name, filedata->handle,
-                    is_thin_archive, do_archive_index) != 0)
+                    filedata->file_size, is_thin_archive,
+                    do_archive_index) != 0)
     {
       ret = FALSE;
       goto out;
@@ -20256,49 +20256,58 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
   if (do_archive_index)
     {
       if (arch.sym_table == NULL)
-       error (_("%s: unable to dump the index as none was found\n"), filedata->file_name);
+       error (_("%s: unable to dump the index as none was found\n"),
+              filedata->file_name);
       else
        {
          unsigned long i, l;
          unsigned long current_pos;
 
-         printf (_("Index of archive %s: (%lu entries, 0x%lx bytes in the symbol table)\n"),
-                 filedata->file_name, (unsigned long) arch.index_num, arch.sym_size);
+         printf (_("Index of archive %s: (%lu entries, 0x%lx bytes "
+                   "in the symbol table)\n"),
+                 filedata->file_name, (unsigned long) arch.index_num,
+                 arch.sym_size);
 
          current_pos = ftell (filedata->handle);
 
          for (i = l = 0; i < arch.index_num; i++)
            {
-             if ((i == 0) || ((i > 0) && (arch.index_array[i] != arch.index_array[i - 1])))
-               {
-                 char * member_name;
-
-                 member_name = get_archive_member_name_at (&arch, arch.index_array[i], &nested_arch);
+             if (i == 0
+                 || (i > 0 && arch.index_array[i] != arch.index_array[i - 1]))
+               {
+                 char * member_name
+                   = get_archive_member_name_at (&arch, arch.index_array[i],
+                                                 &nested_arch);
 
-                  if (member_name != NULL)
-                    {
-                     char * qualified_name = make_qualified_name (&arch, &nested_arch, member_name);
+                 if (member_name != NULL)
+                   {
+                     char * qualified_name
+                       = make_qualified_name (&arch, &nested_arch,
+                                              member_name);
 
-                      if (qualified_name != NULL)
-                        {
-                         printf (_("Contents of binary %s at offset "), qualified_name);
+                     if (qualified_name != NULL)
+                       {
+                         printf (_("Contents of binary %s at offset "),
+                                 qualified_name);
                          (void) print_vma (arch.index_array[i], PREFIX_HEX);
                          putchar ('\n');
-                         free (qualified_name);
-                       }
+                         free (qualified_name);
+                       }
                      free (member_name);
                    }
                }
 
              if (l >= arch.sym_size)
                {
-                 error (_("%s: end of the symbol table reached before the end of the index\n"),
+                 error (_("%s: end of the symbol table reached "
+                          "before the end of the index\n"),
                         filedata->file_name);
                  ret = FALSE;
                  break;
                }
              /* PR 17531: file: 0b6630b2.  */
-             printf ("\t%.*s\n", (int) (arch.sym_size - l), arch.sym_table + l);
+             printf ("\t%.*s\n",
+                     (int) (arch.sym_size - l), arch.sym_table + l);
              l += strnlen (arch.sym_table + l, arch.sym_size - l) + 1;
            }
 
@@ -20322,7 +20331,8 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
 
          if (fseek (filedata->handle, current_pos, SEEK_SET) != 0)
            {
-             error (_("%s: failed to seek back to start of object files in the archive\n"),
+             error (_("%s: failed to seek back to start of object files "
+                      "in the archive\n"),
                     filedata->file_name);
              ret = FALSE;
              goto out;
@@ -20347,34 +20357,37 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
 
       /* Read the next archive header.  */
       if (fseek (filedata->handle, arch.next_arhdr_offset, SEEK_SET) != 0)
-        {
-          error (_("%s: failed to seek to next archive header\n"), arch.file_name);
-          return FALSE;
-        }
+       {
+         error (_("%s: failed to seek to next archive header\n"),
+                arch.file_name);
+         ret = FALSE;
+         break;
+       }
       got = fread (&arch.arhdr, 1, sizeof arch.arhdr, filedata->handle);
       if (got != sizeof arch.arhdr)
-        {
-          if (got == 0)
+       {
+         if (got == 0)
            break;
          /* PR 24049 - we cannot use filedata->file_name as this will
             have already been freed.  */
          error (_("%s: failed to read archive header\n"), arch.file_name);
 
-          ret = FALSE;
-          break;
-        }
+         ret = FALSE;
+         break;
+       }
       if (memcmp (arch.arhdr.ar_fmag, ARFMAG, 2) != 0)
-        {
-          error (_("%s: did not find a valid archive header\n"), arch.file_name);
-          ret = FALSE;
-          break;
-        }
+       {
+         error (_("%s: did not find a valid archive header\n"),
+                arch.file_name);
+         ret = FALSE;
+         break;
+       }
 
       arch.next_arhdr_offset += sizeof arch.arhdr;
 
       archive_file_size = strtoul (arch.arhdr.ar_size, NULL, 10);
       if (archive_file_size & 01)
-        ++archive_file_size;
+       ++archive_file_size;
 
       name = get_archive_member_name (&arch, &nested_arch);
       if (name == NULL)
@@ -20395,45 +20408,45 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
        }
 
       if (is_thin_archive && arch.nested_member_origin == 0)
-        {
-          /* This is a proxy for an external member of a thin archive.  */
-          Filedata * member_filedata;
-          char * member_file_name = adjust_relative_path
+       {
+         /* This is a proxy for an external member of a thin archive.  */
+         Filedata * member_filedata;
+         char * member_file_name = adjust_relative_path
            (filedata->file_name, name, namelen);
 
          free (name);
-          if (member_file_name == NULL)
-            {
+         if (member_file_name == NULL)
+           {
              free (qualified_name);
-              ret = FALSE;
-              break;
-            }
+             ret = FALSE;
+             break;
+           }
 
-          member_filedata = open_file (member_file_name);
-          if (member_filedata == NULL)
-            {
-              error (_("Input file '%s' is not readable.\n"), member_file_name);
-              free (member_file_name);
+         member_filedata = open_file (member_file_name);
+         if (member_filedata == NULL)
+           {
+             error (_("Input file '%s' is not readable.\n"), member_file_name);
+             free (member_file_name);
              free (qualified_name);
-              ret = FALSE;
-              break;
-            }
+             ret = FALSE;
+             break;
+           }
 
-          archive_file_offset = arch.nested_member_origin;
+         archive_file_offset = arch.nested_member_origin;
          member_filedata->file_name = qualified_name;
 
-          if (! process_object (member_filedata))
+         if (! process_object (member_filedata))
            ret = FALSE;
 
-          close_file (member_filedata);
-          free (member_file_name);
+         close_file (member_filedata);
+         free (member_file_name);
          free (qualified_name);
-        }
+       }
       else if (is_thin_archive)
-        {
-          Filedata thin_filedata;
+       {
+         Filedata thin_filedata;
 
-          memset (&thin_filedata, 0, sizeof (thin_filedata));
+         memset (&thin_filedata, 0, sizeof (thin_filedata));
 
          /* PR 15140: Allow for corrupt thin archives.  */
          if (nested_arch.file == NULL)
@@ -20447,35 +20460,36 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive)
            }
          free (name);
 
-          /* This is a proxy for a member of a nested archive.  */
-          archive_file_offset = arch.nested_member_origin + sizeof arch.arhdr;
+         /* This is a proxy for a member of a nested archive.  */
+         archive_file_offset = arch.nested_member_origin + sizeof arch.arhdr;
 
-          /* The nested archive file will have been opened and setup by
-             get_archive_member_name.  */
-          if (fseek (nested_arch.file, archive_file_offset, SEEK_SET) != 0)
-            {
-              error (_("%s: failed to seek to archive member.\n"), nested_arch.file_name);
+         /* The nested archive file will have been opened and setup by
+            get_archive_member_name.  */
+         if (fseek (nested_arch.file, archive_file_offset, SEEK_SET) != 0)
+           {
+             error (_("%s: failed to seek to archive member.\n"),
+                    nested_arch.file_name);
              free (qualified_name);
-              ret = FALSE;
-              break;
-            }
+             ret = FALSE;
+             break;
+           }
 
          thin_filedata.handle = nested_arch.file;
          thin_filedata.file_name = qualified_name;
 
-          if (! process_object (& thin_filedata))
+         if (! process_object (& thin_filedata))
            ret = FALSE;
-        }
+       }
       else
-        {
+       {
          free (name);
-          archive_file_offset = arch.next_arhdr_offset;
-          arch.next_arhdr_offset += archive_file_size;
+         archive_file_offset = arch.next_arhdr_offset;
+         arch.next_arhdr_offset += archive_file_size;
 
          filedata->file_name = qualified_name;
-          if (! process_object (filedata))
+         if (! process_object (filedata))
            ret = FALSE;
-        }
+       }
 
       free (qualified_name);
     }
@@ -20570,7 +20584,9 @@ process_file (char * file_name)
   free (filedata);
 
   free (ba_cache.strtab);
+  ba_cache.strtab = NULL;
   free (ba_cache.symtab);
+  ba_cache.symtab = NULL;
   ba_cache.filedata = NULL;
 
   return ret;
This page took 0.032615 seconds and 4 git commands to generate.