From 36e9d67b868c85232ab630514260f0d9c9c6b27b Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Mon, 10 Nov 2014 14:18:45 +0000
Subject: More fixes for problems exposed by valgrind and the address sanitizer
 when displaying the contents of corrupt files.

	PR binutils/17521
	* coff-i386.c (NUM_HOWTOS): New define.
	(RTYPE2HOWTO): Use it.
	(coff_i386_rtype_to_howto): Likewise.
	(coff_i386_reloc_name_lookup): Likewise.
	(CALC_ADDEND): Check that reloc r_type field is valid.
	* coff-x86_64.c (NUM_HOWTOS): New define.
	(RTYPE2HOWTO): Use it.
	(coff_amd64_rtype_to_howto): Likewise.
	(coff_amd64_reloc_name_lookup): Likewise.
	(CALC_ADDEND): Check that reloc r_type field is valid.
	* coffcode.h (coff_slurp_line_table): Check for symbol table
	indexing underflow.
	(coff_slurp_symbol_table): Use zalloc to ensure that all table
	entries are initialised.
	* coffgen.c (_bfd_coff_read_string_table): Initialise unused bits
	in the string table.  Also ensure that the table is 0 terminated.
	(coff_get_normalized_symtab): Check for symbol table indexing
	underflow.
	* opncls.c (bfd_alloc): Catch the case where a small negative size
	can result in only 1 byte being allocated.
	(bfd_alloc2): Use bfd_alloc.
	* pe-mips.c (NUM_HOWTOS): New define.
	(coff_mips_reloc_name_lookup): Use it.
	(CALC_ADDEND): Check that reloc r_type field is valid.
	* peXXigen.c (_bfd_XXi_swap_aouthdr_in): Initialise unused entries
	in the DataDirectory.
	(pe_print_idata): Avoid reading beyond the end of the data block
	wen printing strings.
	(pe_print_edata): Likewise.
	Check for table indexing underflow.
	* peicode.h (pe_mkobject): Initialise the pe_opthdr field.
	(pe_bfd_object_p): Allocate and initialize enough space to hold a
	PEAOUTHDR, even if the opt_hdr field specified less.
---
 bfd/coffcode.h | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

(limited to 'bfd/coffcode.h')

diff --git a/bfd/coffcode.h b/bfd/coffcode.h
index 3abb6a3df62..8c6b1dd9eb2 100644
--- a/bfd/coffcode.h
+++ b/bfd/coffcode.h
@@ -4032,8 +4032,6 @@ coff_write_object_contents (bfd * abfd)
     internal_f.f_flags |= F_DYNLOAD;
 #endif
 
-  memset (&internal_a, 0, sizeof internal_a);
-
   /* Set up architecture-dependent stuff.  */
   {
     unsigned int magic = 0;
@@ -4569,8 +4567,7 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 
 	  /* PR 17512 file: 078-10659-0.004  */
 	  if (sym < obj_symbols (abfd)
-	      || sym > obj_symbols (abfd)
-	      + obj_raw_syment_count (abfd) * sizeof (coff_symbol_type))
+	      || sym > obj_symbols (abfd) + obj_raw_syment_count (abfd))
 	    sym = NULL;
 
 	  cache_ptr->u.sym = (asymbol *) sym;
@@ -4683,7 +4680,7 @@ coff_slurp_symbol_table (bfd * abfd)
 
   amt = obj_raw_syment_count (abfd);
   amt *= sizeof (unsigned int);
-  table_ptr = (unsigned int *) bfd_alloc (abfd, amt);
+  table_ptr = (unsigned int *) bfd_zalloc (abfd, amt);
 
   if (table_ptr == NULL)
     return FALSE;
@@ -4697,8 +4694,8 @@ coff_slurp_symbol_table (bfd * abfd)
 	{
 	  combined_entry_type *src = native_symbols + this_index;
 	  table_ptr[this_index] = number_of_symbols;
-	  dst->symbol.the_bfd = abfd;
 
+	  dst->symbol.the_bfd = abfd;
 	  dst->symbol.name = (char *) (src->u.syment._n._n_n._n_offset);
 	  /* We use the native name field to point to the cached field.  */
 	  src->u.syment._n._n_n._n_zeroes = (bfd_hostptr_t) dst;
-- 
cgit v1.2.1