X-Git-Url: http://git.efficios.com/?a=blobdiff_plain;f=binutils%2Frddbg.c;h=4a690f628220952a8b5168ff25e6d702c01b24eb;hb=9be2ae8fc6b908746d9d7ebaf77aec8abba5dd2c;hp=27abd66a489bf653ed1cf1aeabb43053eae4594a;hpb=3d540e936bbc1b6971acd7bbb623b92a704f537e;p=deliverable%2Fbinutils-gdb.git

diff --git a/binutils/rddbg.c b/binutils/rddbg.c
index 27abd66a48..4a690f6282 100644
--- a/binutils/rddbg.c
+++ b/binutils/rddbg.c
@@ -1,6 +1,5 @@
 /* rddbg.c -- Read debugging information into a generic form.
-   Copyright 1995, 1996, 1997, 2000, 2002, 2003, 2005, 2007, 2008,
-   2010  Free Software Foundation, Inc.
+   Copyright (C) 1995-2018 Free Software Foundation, Inc.
    Written by Ian Lance Taylor <ian@cygnus.com>.
 
    This file is part of GNU Binutils.
@@ -36,7 +35,6 @@ static bfd_boolean read_section_stabs_debugging_info
   (bfd *, asymbol **, long, void *, bfd_boolean *);
 static bfd_boolean read_symbol_stabs_debugging_info
   (bfd *, asymbol **, long, void *, bfd_boolean *);
-static bfd_boolean read_ieee_debugging_info (bfd *, void *, bfd_boolean *);
 static void save_stab (int, int, bfd_vma, const char *);
 static void stab_context (void);
 static void free_saved_stabs (void);
@@ -65,12 +63,6 @@ read_debugging_info (bfd *abfd, asymbol **syms, long symcount, bfd_boolean no_me
 	return NULL;
     }
 
-  if (bfd_get_flavour (abfd) == bfd_target_ieee_flavour)
-    {
-      if (! read_ieee_debugging_info (abfd, dhandle, &found))
-	return NULL;
-    }
-
   /* Try reading the COFF symbols if we didn't find any stabs in COFF
      sections.  */
   if (! found
@@ -140,7 +132,7 @@ read_section_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 	    }
 
 	  strsize = bfd_section_size (abfd, strsec);
-	  strings = (bfd_byte *) xmalloc (strsize);
+	  strings = (bfd_byte *) xmalloc (strsize + 1);
 	  if (! bfd_get_section_contents (abfd, strsec, strings, 0, strsize))
 	    {
 	      fprintf (stderr, "%s: %s: %s\n",
@@ -148,7 +140,8 @@ read_section_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 		       bfd_errmsg (bfd_get_error ()));
 	      return FALSE;
 	    }
-
+	  /* Zero terminate the strings table, just in case.  */
+	  strings [strsize] = 0;
 	  if (shandle == NULL)
 	    {
 	      shandle = start_stab (dhandle, abfd, TRUE, syms, symcount);
@@ -160,7 +153,8 @@ read_section_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 
 	  stroff = 0;
 	  next_stroff = 0;
-	  for (stab = stabs; stab < stabs + stabsize; stab += 12)
+	  /* PR 17512: file: 078-60391-0.001:0.1.  */
+	  for (stab = stabs; stab <= (stabs + stabsize) - 12; stab += 12)
 	    {
 	      unsigned int strx;
 	      int type;
@@ -185,33 +179,43 @@ read_section_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 		}
 	      else
 		{
+		  size_t len;
 		  char *f, *s;
 
-		  f = NULL;
-
-		  if (stroff + strx > strsize)
+		  if (stroff + strx >= strsize)
 		    {
-		      fprintf (stderr, "%s: %s: stab entry %ld is corrupt, strx = 0x%x, type = %d\n",
+		      fprintf (stderr, _("%s: %s: stab entry %ld is corrupt, strx = 0x%x, type = %d\n"),
 			       bfd_get_filename (abfd), names[i].secname,
 			       (long) (stab - stabs) / 12, strx, type);
 		      continue;
 		    }
 
 		  s = (char *) strings + stroff + strx;
+		  f = NULL;
 
-		  while (s[strlen (s) - 1] == '\\'
+		  /* PR 17512: file: 002-87578-0.001:0.1.
+		     It is possible to craft a file where, without the 'strlen (s) > 0',
+		     an attempt to read the byte before 'strings' would occur.  */
+		  while ((len = strlen (s)) > 0
+			 && s[len  - 1] == '\\'
 			 && stab + 12 < stabs + stabsize)
 		    {
 		      char *p;
 
 		      stab += 12;
-		      p = s + strlen (s) - 1;
+		      p = s + len - 1;
 		      *p = '\0';
-		      s = concat (s,
-				  ((char *) strings
-				   + stroff
-				   + bfd_get_32 (abfd, stab)),
-				  (const char *) NULL);
+		      strx = stroff + bfd_get_32 (abfd, stab);
+		      if (strx >= strsize)
+			{
+			  fprintf (stderr, _("%s: %s: stab entry %ld is corrupt\n"),
+				   bfd_get_filename (abfd), names[i].secname,
+				   (long) (stab - stabs) / 12);
+			  break;
+			}
+		      else
+			s = concat (s, (char *) strings + strx,
+				    (const char *) NULL);
 
 		      /* We have to restore the backslash, because, if
 			 the linker is hashing stabs strings, we may
@@ -288,8 +292,12 @@ read_symbol_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 	  *pfound = TRUE;
 
 	  s = i.name;
+	  if (s == NULL || strlen (s) < 1)
+	    return FALSE;
 	  f = NULL;
-	  while (s[strlen (s) - 1] == '\\'
+
+	  while (strlen (s) > 0
+		 && s[strlen (s) - 1] == '\\'
 		 && ps + 1 < symend)
 	    {
 	      char *sc, *n;
@@ -331,37 +339,6 @@ read_symbol_stabs_debugging_info (bfd *abfd, asymbol **syms, long symcount,
 
   return TRUE;
 }
-
-/* Read IEEE debugging information.  */
-
-static bfd_boolean
-read_ieee_debugging_info (bfd *abfd, void *dhandle, bfd_boolean *pfound)
-{
-  asection *dsec;
-  bfd_size_type size;
-  bfd_byte *contents;
-
-  /* The BFD backend puts the debugging information into a section
-     named .debug.  */
-
-  dsec = bfd_get_section_by_name (abfd, ".debug");
-  if (dsec == NULL)
-    return TRUE;
-
-  size = bfd_section_size (abfd, dsec);
-  contents = (bfd_byte *) xmalloc (size);
-  if (! bfd_get_section_contents (abfd, dsec, contents, 0, size))
-    return FALSE;
-
-  if (! parse_ieee (dhandle, abfd, contents, size))
-    return FALSE;
-
-  free (contents);
-
-  *pfound = TRUE;
-
-  return TRUE;
-}
 
 /* Record stabs strings, so that we can give some context for errors.  */