2005-06-21 Jakub Jelinek * libbfd-in.h (struct artdata): Add extended_names_size field. * libbfd.h: Rebuilt. * coff-rs600.c (_bfd_xcoff_archive_p): Don't clear fields in freshly allocated object by bfd_zalloc. * coff64-rs6000.c (xcoff64_archive_p): Likewise. * ecoff.c (_bfd_ecoff_archive_p): Likewise. * archive.c (_bfd_generic_mkarchive, bfd_generic_archive_p): Likewise. (get_extended_arelt_filename): Fail if index is bigger or equal to extended_names_size. (_bfd_generic_read_ar_hdr_mag): Don't set bfd_error_malformed_archive, get_extended_arelt_filename already did that. (_bfd_slurp_extended_name_table): Initialize extended_names_size field. Allocate one extra byte and clear it, in case extended names table is not terminated. --- bfd/libbfd-in.h.jj 2005-06-20 12:16:18.000000000 +0200 +++ bfd/libbfd-in.h 2005-06-21 18:45:56.000000000 +0200 @@ -64,6 +64,7 @@ struct artdata { carsym *symdefs; /* the symdef entries */ symindex symdef_count; /* how many there are */ char *extended_names; /* clever intel extension */ + bfd_size_type extended_names_size; /* Size of extended names */ /* when more compilers are standard C, this can be a time_t */ long armap_timestamp; /* Timestamp value written into armap. This is used for BSD archives to check --- bfd/libbfd.h.jj 2005-06-20 12:16:18.000000000 +0200 +++ bfd/libbfd.h 2005-06-21 18:46:32.000000000 +0200 @@ -69,6 +69,7 @@ struct artdata { carsym *symdefs; /* the symdef entries */ symindex symdef_count; /* how many there are */ char *extended_names; /* clever intel extension */ + bfd_size_type extended_names_size; /* Size of extended names */ /* when more compilers are standard C, this can be a time_t */ long armap_timestamp; /* Timestamp value written into armap. This is used for BSD archives to check --- bfd/coff64-rs6000.c.jj 2005-06-09 10:58:49.000000000 +0200 +++ bfd/coff64-rs6000.c 2005-06-21 18:59:07.000000000 +0200 @@ -1983,10 +1983,12 @@ xcoff64_archive_p (abfd) if (bfd_ardata (abfd) == (struct artdata *) NULL) goto error_ret_restore; - bfd_ardata (abfd)->cache = NULL; - bfd_ardata (abfd)->archive_head = NULL; - bfd_ardata (abfd)->symdefs = NULL; - bfd_ardata (abfd)->extended_names = NULL; + /* Already cleared by bfd_zalloc above. + bfd_ardata (abfd)->cache = NULL; + bfd_ardata (abfd)->archive_head = NULL; + bfd_ardata (abfd)->symdefs = NULL; + bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; */ bfd_ardata (abfd)->first_file_filepos = bfd_scan_vma (hdr.firstmemoff, (const char **) NULL, 10); --- bfd/coff-rs6000.c.jj 2005-06-09 10:58:49.000000000 +0200 +++ bfd/coff-rs6000.c 2005-06-21 18:56:11.000000000 +0200 @@ -1294,10 +1294,12 @@ _bfd_xcoff_archive_p (abfd) if (bfd_ardata (abfd) == (struct artdata *) NULL) goto error_ret_restore; - bfd_ardata (abfd)->cache = NULL; - bfd_ardata (abfd)->archive_head = NULL; - bfd_ardata (abfd)->symdefs = NULL; - bfd_ardata (abfd)->extended_names = NULL; + /* Cleared by bfd_zalloc above. + bfd_ardata (abfd)->cache = NULL; + bfd_ardata (abfd)->archive_head = NULL; + bfd_ardata (abfd)->symdefs = NULL; + bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; */ /* Now handle the two formats. */ if (magic[1] != 'b') --- bfd/ecoff.c.jj 2005-05-13 23:44:07.000000000 +0200 +++ bfd/ecoff.c 2005-06-21 18:59:49.000000000 +0200 @@ -3182,11 +3182,13 @@ _bfd_ecoff_archive_p (bfd *abfd) } bfd_ardata (abfd)->first_file_filepos = SARMAG; - bfd_ardata (abfd)->cache = NULL; - bfd_ardata (abfd)->archive_head = NULL; - bfd_ardata (abfd)->symdefs = NULL; - bfd_ardata (abfd)->extended_names = NULL; - bfd_ardata (abfd)->tdata = NULL; + /* Already cleared by bfd_zalloc above. + bfd_ardata (abfd)->cache = NULL; + bfd_ardata (abfd)->archive_head = NULL; + bfd_ardata (abfd)->symdefs = NULL; + bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; + bfd_ardata (abfd)->tdata = NULL; */ if (! _bfd_ecoff_slurp_armap (abfd) || ! _bfd_ecoff_slurp_extended_name_table (abfd)) --- bfd/archive.c.jj 2005-06-17 15:22:56.000000000 +0200 +++ bfd/archive.c 2005-06-21 19:03:51.000000000 +0200 @@ -182,11 +182,13 @@ _bfd_generic_mkarchive (bfd *abfd) if (bfd_ardata (abfd) == NULL) return FALSE; - bfd_ardata (abfd)->cache = NULL; - bfd_ardata (abfd)->archive_head = NULL; - bfd_ardata (abfd)->symdefs = NULL; - bfd_ardata (abfd)->extended_names = NULL; - bfd_ardata (abfd)->tdata = NULL; + /* Already cleared by bfd_zalloc above. + bfd_ardata (abfd)->cache = NULL; + bfd_ardata (abfd)->archive_head = NULL; + bfd_ardata (abfd)->symdefs = NULL; + bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; + bfd_ardata (abfd)->tdata = NULL; */ return TRUE; } @@ -335,7 +337,7 @@ get_extended_arelt_filename (bfd *arch, errno = 0; /* Skip first char, which is '/' in SVR4 or ' ' in some other variants. */ index = strtol (name + 1, NULL, 10); - if (errno != 0) + if (errno != 0 || index >= bfd_ardata (arch)->extended_names_size) { bfd_set_error (bfd_error_malformed_archive); return NULL; @@ -405,10 +407,7 @@ _bfd_generic_read_ar_hdr_mag (bfd *abfd, { filename = get_extended_arelt_filename (abfd, hdr.ar_name); if (filename == NULL) - { - bfd_set_error (bfd_error_malformed_archive); - return NULL; - } + return NULL; } /* BSD4.4-style long filename. Only implemented for reading, so far! */ @@ -629,11 +628,13 @@ bfd_generic_archive_p (bfd *abfd) } bfd_ardata (abfd)->first_file_filepos = SARMAG; - bfd_ardata (abfd)->cache = NULL; - bfd_ardata (abfd)->archive_head = NULL; - bfd_ardata (abfd)->symdefs = NULL; - bfd_ardata (abfd)->extended_names = NULL; - bfd_ardata (abfd)->tdata = NULL; + /* Cleared by bfd_zalloc above. + bfd_ardata (abfd)->cache = NULL; + bfd_ardata (abfd)->archive_head = NULL; + bfd_ardata (abfd)->symdefs = NULL; + bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; + bfd_ardata (abfd)->tdata = NULL; */ if (!BFD_SEND (abfd, _bfd_slurp_armap, (abfd)) || !BFD_SEND (abfd, _bfd_slurp_extended_name_table, (abfd))) @@ -1067,6 +1068,7 @@ _bfd_slurp_extended_name_table (bfd *abf strncmp (nextname, "// ", 16) != 0) { bfd_ardata (abfd)->extended_names = NULL; + bfd_ardata (abfd)->extended_names_size = 0; return TRUE; } @@ -1075,7 +1077,11 @@ _bfd_slurp_extended_name_table (bfd *abf return FALSE; amt = namedata->parsed_size; - bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt); + if (amt + 1 == 0) + goto byebye; + + bfd_ardata (abfd)->extended_names_size = amt; + bfd_ardata (abfd)->extended_names = bfd_zalloc (abfd, amt + 1); if (bfd_ardata (abfd)->extended_names == NULL) { byebye: @@ -1098,15 +1104,17 @@ _bfd_slurp_extended_name_table (bfd *abf trailing '/'. DOS/NT created archive often have \ in them We'll fix all problems here.. */ { - char *temp = bfd_ardata (abfd)->extended_names; + char *ext_names = bfd_ardata (abfd)->extended_names; + char *temp = ext_names; char *limit = temp + namedata->parsed_size; for (; temp < limit; ++temp) { if (*temp == '\012') - temp[temp[-1] == '/' ? -1 : 0] = '\0'; + temp[temp > ext_names && temp[-1] == '/' ? -1 : 0] = '\0'; if (*temp == '\\') *temp = '/'; } + *limit = '\0'; } /* Pad to an even boundary if you have to. */