From fa6631b4eecfcca00c13b9594e6336dffd40982f Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Mon, 5 Dec 2016 16:34:45 +0000 Subject: [PATCH] Fix seg-fault in the binutils utilities when reading a corrupt input file. PR binutils/20905 * peicode.h (pe_ILF_object_p): Use strnlen to avoid running over the end of the string buffer. --- bfd/ChangeLog | 4 ++++ bfd/peicode.h | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 8dc48b3..9a7bfcd 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -5,6 +5,10 @@ 2016-12-05 Nick Clifton + PR binutils/20905 + * peicode.h (pe_ILF_object_p): Use strnlen to avoid running over + the end of the string buffer. + PR binutils/20907 * peicode.h (pe_ILF_build_a_bfd): Replace abort with error return. diff --git a/bfd/peicode.h b/bfd/peicode.h index ee47a67..5d55711 100644 --- a/bfd/peicode.h +++ b/bfd/peicode.h @@ -1269,7 +1269,8 @@ pe_ILF_object_p (bfd * abfd) } symbol_name = (char *) ptr; - source_dll = symbol_name + strlen (symbol_name) + 1; + /* See PR 20905 for an example of where the strnlen is necessary. */ + source_dll = symbol_name + strnlen (symbol_name, size - 1) + 1; /* Verify that the strings are null terminated. */ if (ptr[size - 1] != 0 -- 2.7.4