[Bug binutils/24707] binutils crash invoke files, by using afl fuzzing

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=24707

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot 
gnu.org> ---
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=87d206578e152d81d903a0beec8bd3927154eb30

commit 87d206578e152d81d903a0beec8bd3927154eb30
Author: Alan Modra <amodra@gmail.com>
Date:   Wed Feb 8 14:41:58 2023 +1030

    Clear cached file size when bfd changed to BFD_IN_MEMORY

    If file size is calculated by bfd_get_file_size, as it is by
    _bfd_alloc_and_read calls in coff_object_p, then it is cached and when
    pe_ILF_build_a_bfd converts an archive entry over to BFD_IN_MEMORY,
    the file size is no longer valid.  Found when attempting objdump -t on
    a very small (27 bytes) ILF file and hitting the pr24707 fix (commit
    781152ec18f5).  So, clear file size when setting BFD_IN_MEMORY on bfds
    that may have been read.  (It's not necessary in writable bfds,
    because caching is ignored by bfd_get_size when bfd_write_p.)

    I also think the PR 24707 fix is no longer neeeded.  All of the
    testcases in that PR and in PR24712 are caught earlier by file size
    checks when reading the symbols from file.  So I'm reverting that fix,
    which just compared the size of an array of symbol pointers against
    file size.  That's only valid if on-disk symbols are larger than a
    host pointer, so the test is better done in format-specific code.

    bfd/
            * coff-alpha.c (alpha_ecoff_get_elt_at_filepos): Clear cached
            file size when making a BFD_IN_MEMORY bfd.
            * opncls.c (bfd_make_readable): Likewise.
            * peicode.h (pe_ILF_build_a_bfd): Likewise.
    binutils/
            PR 24707
            * objdump.c (slurp_symtab): Revert PR24707 fix.  Tidy.
            (slurp_dynamic_symtab): Tidy.

-- 
You are receiving this mail because:
You are on the CC list for the bug.