asan: som: heap-buffer-overflow

[deliverable/binutils-gdb.git] / bfd / ChangeLog

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 61ef89fa1c7ec76d6d113a148064b39912a65c99..838d9ee0b4c98e301d14e4cb990f67e78dec0b80 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,85 @@
+2019-12-26  Alan Modra  <amodra@gmail.com>
+
+       * som.c (setup_sections): Don't overflow space_strings_size.  Use
+       bfd_malloc2 to catch overflow of size calculation.
+       (som_prep_for_fixups): Use bfd_zalloc2 to catch overflow of size
+       calculation.
+       (som_build_and_write_symbol_table): Similarly use bfd_zmalloc2.
+       (som_slurp_symbol_table): Similarly use bfd_zmalloc2, bfd_malloc2,
+       and bfd_zalloc2.
+       (bfd_som_attach_aux_hdr): Use size_t vars for string length.
+       (som_bfd_count_ar_symbols): Use bfd_malloc2 to catch overflow of
+       size calculation.  Use size_t vars for length and catch overflow.
+       (som_slurp_armap): Use bfd_alloc2 to catch overflow of size
+       calculation.
+       (som_bfd_ar_write_symbol_stuff): Similarly use bfd_zmalloc2 and
+       bfd_malloc2.  Perform size calculations in bfd_size_type.
+
+2019-12-26  Hannes Domani  <ssbssa@yahoo.de>
+
+       * peicode.h (pe_bfd_read_buildid): Free data.
+
+2019-12-23  Alan Modra  <amodra@gmail.com>
+
+       * vms-alpha.c (add_symbol): Add "max" parameter.  Error on string
+       length larger than max.
+       (_bfd_vms_slurp_egsd): Ensure record is at least large enough to
+       read string length byte, error if not.  Pass size to add_symbol.
+       (_bfd_vms_slurp_etir): Don't read past end of buffer when reading
+       type and length.  Allow read of last byte in buffer.
+
+2019-12-23  Alan Modra  <amodra@gmail.com>
+
+       * wasm-module.c (wasm_read_leb128): Don't allow oversize shifts.
+       Catch value overflow.  Sign extend only on terminating byte.
+
+2019-12-20  Alan Modra  <amodra@gmail.com>
+
+       * xtensa-isa.c (xtensa_insnbuf_from_chars): Avoid signed overflow.
+
+2019-12-20  Alan Modra  <amodra@gmail.com>
+
+       * libhppa.h (hppa_field_adjust, bfd_hppa_insn2fmt): Delete forward
+       declaration.  Move ATTRIBUTE_UNUSED to definition.
+       (sign_extend, low_sign_extend, sign_unext, low_sign_unext),
+       (re_assemble_3, re_assemble_12, re_assemble_14, re_assemble_16),
+       (re_assemble_17, re_assemble_21, re_assemble_22): Likewise.  Make
+       args and return value unsigned.  Use unsigned variables.
+       (hppa_rebuild_insn): Similarly.
+
+2019-12-20  Alan Modra  <amodra@gmail.com>
+
+       * format.c (bfd_check_format_matches): Free matching_vector when
+       not returning matching target strings.
+
+2019-12-20  Alan Modra  <amodra@gmail.com>
+
+       * coff-alpha.c (alpha_ecoff_read_ar_hdr): Free ar_hdr on error return.
+
+2019-12-18  Alan Modra  <amodra@gmail.com>
+
+       * coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when
+       checking symbol count against section size.  Guard against strlen
+       running off end of buffer by allocating one more byte and zeroing.
+       * coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
+
+2019-12-18  Alan Modra  <amodra@gmail.com>
+
+       * elf32-ppc.c (ppc_elf_get_synthetic_symtab): Use size_t for vars.
+       * elf64-ppc.c (sym_exists_at): Use size_t for lo, hi and mid.
+
+2019-12-18  Alan Modra  <amodra@gmail.com>
+
+       * elf-bfd.h (ELF_LOCAL_SYMBOL_HASH): Avoid signed overflow.
+       * elf32-hppa.c (final_link_relocate): Likewise.
+       * elf32-ppc.c (_bfd_elf_ppc_at_tls_transform): Likewise.
+       (_bfd_elf_ppc_at_tprel_transform, is_insn_ds_form): Likewise.
+       (is_insn_dq_form, ppc_elf_relocate_section): Likewise.
+       * elf64-ppc.c (ok_lo_toc_insn, ppc64_elf_edit_toc): Likewise.
+       (ppc64_elf_relocate_section): Likewise.
+       * elfxx-mips.c (mips_elf_perform_relocation): Likewise.
+       * netbsd.h (N_SET_FLAGS): Likewise.
+
 2019-12-17  Alan Modra  <amodra@gmail.com>
 
        * coff-tic80.c: Delete file.