Fix excessive memory allocation attempts and possible integer overfloaws when attempt...

[deliverable/binutils-gdb.git] / bfd / coffgen.c

diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index d2cc59184909df965cf22d9bcf38832410c0b798..81efd9b372435370a02043c0cfcbdc4c70d22366 100644 (file)
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1640,10 +1640,25 @@ _bfd_coff_get_external_symbols (bfd *abfd)
   size = obj_raw_syment_count (abfd) * symesz;
   if (size == 0)
     return TRUE;
+  /* Check for integer overflow and for unreasonable symbol counts.  */
+  if (size < obj_raw_syment_count (abfd)
+      || (bfd_get_file_size (abfd) > 0
+         && size > bfd_get_file_size (abfd)))
+    
+    {
+      _bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
+                         abfd, obj_raw_syment_count (abfd));
+      return FALSE;
+    }
 
   syms = bfd_malloc (size);
   if (syms == NULL)
-    return FALSE;
+    {
+      /* PR 21013: Provide an error message when the alloc fails.  */
+      _bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
+                         abfd, obj_raw_syment_count (abfd), symesz);
+      return FALSE;
+    }
 
   if (bfd_seek (abfd, obj_sym_filepos (abfd), SEEK_SET) != 0
       || bfd_bread (syms, size, abfd) != size)
@@ -1654,7 +1669,6 @@ _bfd_coff_get_external_symbols (bfd *abfd)
     }
 
   obj_coff_external_syms (abfd) = syms;
-
   return TRUE;
 }
 
@@ -1708,7 +1722,7 @@ _bfd_coff_read_string_table (bfd *abfd)
     {
       _bfd_error_handler
        /* xgettext: c-format */
-       (_("%B: bad string table size %lu"), abfd, (unsigned long) strsize);
+       (_("%B: bad string table size %Lu"), abfd, strsize);
       bfd_set_error (bfd_error_bad_value);
       return NULL;
     }
@@ -1742,12 +1756,16 @@ _bfd_coff_read_string_table (bfd *abfd)
 bfd_boolean
 _bfd_coff_free_symbols (bfd *abfd)
 {
+  if (! bfd_family_coff (abfd))
+    return FALSE;
+
   if (obj_coff_external_syms (abfd) != NULL
       && ! obj_coff_keep_syms (abfd))
     {
       free (obj_coff_external_syms (abfd));
       obj_coff_external_syms (abfd) = NULL;
     }
+
   if (obj_coff_strings (abfd) != NULL
       && ! obj_coff_keep_strings (abfd))
     {
@@ -1755,6 +1773,7 @@ _bfd_coff_free_symbols (bfd *abfd)
       obj_coff_strings (abfd) = NULL;
       obj_coff_strings_len (abfd) = 0;
     }
+
   return TRUE;
 }
 
@@ -1785,6 +1804,9 @@ coff_get_normalized_symtab (bfd *abfd)
     return NULL;
 
   size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
+  /* Check for integer overflow.  */
+  if (size < obj_raw_syment_count (abfd))
+    return NULL;
   internal = (combined_entry_type *) bfd_zalloc (abfd, size);
   if (internal == NULL && size != 0)
     return NULL;
@@ -2254,6 +2276,8 @@ coff_find_nearest_line_with_names (bfd *abfd,
                                     &coff_data(abfd)->dwarf2_find_line_info))
     return TRUE;
 
+  sec_data = coff_section_data (abfd, section);
+
   /* If the DWARF lookup failed, but there is DWARF information available
      then the problem might be that the file has been rebased.  This tool
      changes the VMAs of all the sections, but it does not update the DWARF
@@ -2262,8 +2286,26 @@ coff_find_nearest_line_with_names (bfd *abfd,
     {
       bfd_signed_vma bias;
 
-      bias = _bfd_dwarf2_find_symbol_bias (symbols,
-                                          & coff_data (abfd)->dwarf2_find_line_info);
+      /* Create a cache of the result for the next call.  */
+      if (sec_data == NULL && section->owner == abfd)
+       {
+         amt = sizeof (struct coff_section_tdata);
+         section->used_by_bfd = bfd_zalloc (abfd, amt);
+         sec_data = (struct coff_section_tdata *) section->used_by_bfd;
+       }
+
+      if (sec_data != NULL && sec_data->saved_bias)
+       bias = sec_data->saved_bias;
+      else
+       {
+         bias = _bfd_dwarf2_find_symbol_bias (symbols,
+                                              & coff_data (abfd)->dwarf2_find_line_info);
+         if (sec_data)
+           {
+             sec_data->saved_bias = TRUE;
+             sec_data->bias = bias;
+           }
+       }
 
       if (bias
          && _bfd_dwarf2_find_nearest_line (abfd, symbols, NULL, section,
@@ -2358,10 +2400,16 @@ coff_find_nearest_line_with_names (bfd *abfd,
        }
     }
 
-  /* Now wander though the raw linenumbers of the section.  */
-  /* If we have been called on this section before, and the offset we
-     want is further down then we can prime the lookup loop.  */
-  sec_data = coff_section_data (abfd, section);
+  if (section->lineno_count == 0)
+    {
+      *functionname_ptr = NULL;
+      *line_ptr = 0;
+      return TRUE;
+    }
+
+  /* Now wander though the raw linenumbers of the section.
+     If we have been called on this section before, and the offset
+     we want is further down then we can prime the lookup loop.  */
   if (sec_data != NULL
       && sec_data->i > 0
       && offset >= sec_data->offset)
@@ -2390,6 +2438,7 @@ coff_find_nearest_line_with_names (bfd *abfd,
              coff_symbol_type *coff = (coff_symbol_type *) (l->u.sym);
              if (coff->symbol.value > offset)
                break;
+
              *functionname_ptr = coff->symbol.name;
              last_value = coff->symbol.value;
              if (coff->native)
@@ -2446,6 +2495,7 @@ coff_find_nearest_line_with_names (bfd *abfd,
       section->used_by_bfd = bfd_zalloc (abfd, amt);
       sec_data = (struct coff_section_tdata *) section->used_by_bfd;
     }
+
   if (sec_data != NULL)
     {
       sec_data->offset = offset;
@@ -2752,8 +2802,22 @@ _bfd_coff_gc_mark_hook (asection *sec,
         case bfd_link_hash_common:
           return h->root.u.c.p->section;
 
-       case bfd_link_hash_undefined:
        case bfd_link_hash_undefweak:
+         if (h->symbol_class == C_NT_WEAK && h->numaux == 1)
+           {
+             /* PE weak externals.  A weak symbol may include an auxiliary
+                record indicating that if the weak symbol is not resolved,
+                another external symbol is used instead.  */
+             struct coff_link_hash_entry *h2 =
+               h->auxbfd->tdata.coff_obj_data->sym_hashes[
+                   h->aux->x_sym.x_tagndx.l];
+
+             if (h2 && h2->root.type != bfd_link_hash_undefined)
+               return  h2->root.u.def.section;
+           }
+         break;
+
+       case bfd_link_hash_undefined:
         default:
           break;
         }
@@ -2864,7 +2928,7 @@ _bfd_coff_gc_mark_extra_sections (struct bfd_link_info *info,
       asection *isec;
       bfd_boolean some_kept;
 
-      if (bfd_get_flavour (ibfd) != bfd_target_elf_flavour)
+      if (bfd_get_flavour (ibfd) != bfd_target_coff_flavour)
        continue;
 
       /* Ensure all linker created sections are kept, and see whether
@@ -2957,7 +3021,8 @@ coff_gc_sweep (bfd *abfd ATTRIBUTE_UNUSED, struct bfd_link_info *info)
 
          if (info->print_gc_sections && o->size != 0)
            /* xgettext: c-format */
-            _bfd_error_handler (_("Removing unused section '%s' in file '%B'"), sub, o->name);
+           _bfd_error_handler (_("Removing unused section '%A' in file '%B'"),
+                               o, sub);
 
 #if 0
          /* But we also have to update some of the relocation