This is the mail archive of the
binutils-cvs@sourceware.org
mailing list for the binutils project.
[binutils-gdb] Proper bound check in _bfd_doprnt_scan
- From: Alan Modra <amodra at sourceware dot org>
- To: bfd-cvs at sourceware dot org
- Date: 5 Nov 2017 11:31:16 -0000
- Subject: [binutils-gdb] Proper bound check in _bfd_doprnt_scan
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=26a9301057457ae576b51b8127bb805b4e484a6b
commit 26a9301057457ae576b51b8127bb805b4e484a6b
Author: Alan Modra <amodra@gmail.com>
Date: Sun Nov 5 19:52:13 2017 +1030
Proper bound check in _bfd_doprnt_scan
While an abort after storing out of bounds by one to an array in our
caller is probably OK in practice, it's better to check before storing.
PR 22397
* bfd.c (_bfd_doprnt_scan): Check args index before storing, not
after.
Diff:
---
bfd/ChangeLog | 6 ++++++
bfd/bfd.c | 12 ++++++------
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 80d14ae..2362ca0 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,6 +1,12 @@
2017-11-05 Alan Modra <amodra@gmail.com>
PR 22397
+ * bfd.c (_bfd_doprnt_scan): Check args index before storing, not
+ after.
+
+2017-11-05 Alan Modra <amodra@gmail.com>
+
+ PR 22397
* bfd.c (union _bfd_doprnt_args): New.
(PRINT_TYPE): Add FIELD arg. Take value from args.
(_bfd_doprnt): Replace ap parameter with args. Adjust all
diff --git a/bfd/bfd.c b/bfd/bfd.c
index 006fb2b..35f748c 100644
--- a/bfd/bfd.c
+++ b/bfd/bfd.c
@@ -974,10 +974,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
arg_index = *ptr - '1';
ptr += 2;
}
+ if (arg_index >= 9)
+ abort ();
args[arg_index].type = Int;
arg_count++;
- if (arg_count > 9)
- abort ();
}
else
/* Handle explicit numeric value. */
@@ -999,10 +999,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
arg_index = *ptr - '1';
ptr += 2;
}
+ if (arg_index >= 9)
+ abort ();
args[arg_index].type = Int;
arg_count++;
- if (arg_count > 9)
- abort ();
}
else
/* Handle explicit numeric value. */
@@ -1032,6 +1032,8 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
if ((int) arg_no < 0)
arg_no = arg_count;
+ if (arg_no >= 9)
+ abort ();
switch (ptr[-1])
{
case 'd':
@@ -1100,8 +1102,6 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
abort();
}
arg_count++;
- if (arg_count > 9)
- abort ();
}
}