diff options
author | Deepthi Hemraj <deepadeepthi98@gmail.com> | 2023-05-03 16:22:09 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-05-10 04:19:56 -1000 |
commit | 614a9a6f9f6468ce26ba39f00d3b75fe8b82aff1 (patch) | |
tree | 8d02746b9ea853a31ce87463df2e3268292a02cf | |
parent | 7535036adba287743beae2009bb5ebca6895141b (diff) | |
download | poky-614a9a6f9f6468ce26ba39f00d3b75fe8b82aff1.tar.gz |
binutils : Fix CVE-2023-25584
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44]
(From OE-Core rev: 27278ebd5d102ce5a9d45f94a93932065025657b)
Signed-off-by: Deepthi Hemraj <deepadeepthi98@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
4 files changed, 631 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc index bf44e6c762..69fb8539ba 100644 --- a/meta/recipes-devtools/binutils/binutils-2.38.inc +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc | |||
@@ -50,5 +50,8 @@ SRC_URI = "\ | |||
50 | file://0021-CVE-2023-1579-2.patch \ | 50 | file://0021-CVE-2023-1579-2.patch \ |
51 | file://0021-CVE-2023-1579-3.patch \ | 51 | file://0021-CVE-2023-1579-3.patch \ |
52 | file://0021-CVE-2023-1579-4.patch \ | 52 | file://0021-CVE-2023-1579-4.patch \ |
53 | file://0022-CVE-2023-25584-1.patch \ | ||
54 | file://0022-CVE-2023-25584-2.patch \ | ||
55 | file://0022-CVE-2023-25584-3.patch \ | ||
53 | " | 56 | " |
54 | S = "${WORKDIR}/git" | 57 | S = "${WORKDIR}/git" |
diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch new file mode 100644 index 0000000000..990243f5c9 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From: Alan Modra <amodra@gmail.com> | ||
2 | Date: Thu, 17 Mar 2022 09:35:39 +0000 (+1030) | ||
3 | Subject: ubsan: Null dereference in parse_module | ||
4 | X-Git-Tag: gdb-12.1-release~59 | ||
5 | X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c9178f285acf19e066be8367185d52837161b0a2 | ||
6 | |||
7 | ubsan: Null dereference in parse_module | ||
8 | |||
9 | * vms-alpha.c (parse_module): Sanity check that DST__K_RTNBEG | ||
10 | has set module->func_table for DST__K_RTNEND. Check return | ||
11 | of bfd_zalloc. | ||
12 | |||
13 | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c9178f285acf19e066be8367185d52837161b0a2] | ||
14 | |||
15 | CVE: CVE-2023-25584 | ||
16 | |||
17 | Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> | ||
18 | |||
19 | --- | ||
20 | |||
21 | diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c | ||
22 | index 4a92574c850..1129c98f0e2 100644 | ||
23 | --- a/bfd/vms-alpha.c | ||
24 | +++ b/bfd/vms-alpha.c | ||
25 | @@ -4352,9 +4352,13 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
26 | |||
27 | /* Initialize tables with zero element. */ | ||
28 | curr_srec = (struct srecinfo *) bfd_zalloc (abfd, sizeof (struct srecinfo)); | ||
29 | + if (!curr_srec) | ||
30 | + return false; | ||
31 | module->srec_table = curr_srec; | ||
32 | |||
33 | curr_line = (struct lineinfo *) bfd_zalloc (abfd, sizeof (struct lineinfo)); | ||
34 | + if (!curr_line) | ||
35 | + return false; | ||
36 | module->line_table = curr_line; | ||
37 | |||
38 | while (length == -1 || ptr < maxptr) | ||
39 | @@ -4389,6 +4393,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
40 | case DST__K_RTNBEG: | ||
41 | funcinfo = (struct funcinfo *) | ||
42 | bfd_zalloc (abfd, sizeof (struct funcinfo)); | ||
43 | + if (!funcinfo) | ||
44 | + return false; | ||
45 | funcinfo->name | ||
46 | = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_RTNBEG_NAME, | ||
47 | maxptr - (ptr + DST_S_B_RTNBEG_NAME)); | ||
48 | @@ -4401,6 +4407,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
49 | break; | ||
50 | |||
51 | case DST__K_RTNEND: | ||
52 | + if (!module->func_table) | ||
53 | + return false; | ||
54 | module->func_table->high = module->func_table->low | ||
55 | + bfd_getl32 (ptr + DST_S_L_RTNEND_SIZE) - 1; | ||
56 | |||
diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch new file mode 100644 index 0000000000..f4c5ed2aff --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | From da928f639002002dfc649ed9f50492d5d6cb4cee Mon Sep 17 00:00:00 2001 | ||
2 | From: Nick Clifton <nickc@redhat.com> | ||
3 | Date: Mon, 5 Dec 2022 11:11:44 +0000 | ||
4 | Subject: [PATCH] Fix an illegal memory access when parsing a corrupt VMS Alpha | ||
5 | file. | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | Fix an illegal memory access when parsing a corrupt VMS Alpha file. | ||
11 | |||
12 | PR 29848 | ||
13 | * vms-alpha.c (parse_module): Fix potential out of bounds memory | ||
14 | access. | ||
15 | |||
16 | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=942fa4fb32738ecbb447546d54f1e5f0312d2ed4] | ||
17 | |||
18 | CVE: CVE-2023-25584 | ||
19 | |||
20 | Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> | ||
21 | |||
22 | --- | ||
23 | bfd/vms-alpha.c | 2 +- | ||
24 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
25 | |||
26 | diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c | ||
27 | index c548722c..53b3f1bf 100644 | ||
28 | --- a/bfd/vms-alpha.c | ||
29 | +++ b/bfd/vms-alpha.c | ||
30 | @@ -4361,7 +4361,7 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
31 | return false; | ||
32 | module->line_table = curr_line; | ||
33 | |||
34 | - while (length == -1 || ptr < maxptr) | ||
35 | + while (length == -1 || (ptr + 3) < maxptr) | ||
36 | { | ||
37 | /* The first byte is not counted in the recorded length. */ | ||
38 | int rec_length = bfd_getl16 (ptr) + 1; | ||
diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch new file mode 100644 index 0000000000..abe501e570 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch | |||
@@ -0,0 +1,534 @@ | |||
1 | From: Alan Modra <amodra@gmail.com> | ||
2 | Date: Mon, 12 Dec 2022 07:58:49 +0000 (+1030) | ||
3 | Subject: Lack of bounds checking in vms-alpha.c parse_module | ||
4 | X-Git-Tag: gdb-13-branchpoint~87 | ||
5 | X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=77c225bdeb410cf60da804879ad41622f5f1aa44 | ||
6 | |||
7 | Lack of bounds checking in vms-alpha.c parse_module | ||
8 | |||
9 | PR 29873 | ||
10 | PR 29874 | ||
11 | PR 29875 | ||
12 | PR 29876 | ||
13 | PR 29877 | ||
14 | PR 29878 | ||
15 | PR 29879 | ||
16 | PR 29880 | ||
17 | PR 29881 | ||
18 | PR 29882 | ||
19 | PR 29883 | ||
20 | PR 29884 | ||
21 | PR 29885 | ||
22 | PR 29886 | ||
23 | PR 29887 | ||
24 | PR 29888 | ||
25 | PR 29889 | ||
26 | PR 29890 | ||
27 | PR 29891 | ||
28 | * vms-alpha.c (parse_module): Make length param bfd_size_type. | ||
29 | Delete length == -1 checks. Sanity check record_length. | ||
30 | Sanity check DST__K_MODBEG, DST__K_RTNBEG, DST__K_RTNEND lengths. | ||
31 | Sanity check DST__K_SOURCE and DST__K_LINE_NUM elements | ||
32 | before accessing. | ||
33 | (build_module_list): Pass dst_section size to parse_module. | ||
34 | |||
35 | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=77c225bdeb410cf60da804879ad41622f5f1aa44] | ||
36 | |||
37 | CVE: CVE-2023-25584 | ||
38 | |||
39 | Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> | ||
40 | |||
41 | --- | ||
42 | |||
43 | diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c | ||
44 | index c0eb5bc5a2a..3b63259cc81 100644 | ||
45 | --- a/bfd/vms-alpha.c | ||
46 | +++ b/bfd/vms-alpha.c | ||
47 | @@ -4340,7 +4340,7 @@ new_module (bfd *abfd) | ||
48 | |||
49 | static bool | ||
50 | parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
51 | - int length) | ||
52 | + bfd_size_type length) | ||
53 | { | ||
54 | unsigned char *maxptr = ptr + length; | ||
55 | unsigned char *src_ptr, *pcl_ptr; | ||
56 | @@ -4361,7 +4361,7 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
57 | return false; | ||
58 | module->line_table = curr_line; | ||
59 | |||
60 | - while (length == -1 || (ptr + 3) < maxptr) | ||
61 | + while (ptr + 3 < maxptr) | ||
62 | { | ||
63 | /* The first byte is not counted in the recorded length. */ | ||
64 | int rec_length = bfd_getl16 (ptr) + 1; | ||
65 | @@ -4369,15 +4369,19 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
66 | |||
67 | vms_debug2 ((2, "DST record: leng %d, type %d\n", rec_length, rec_type)); | ||
68 | |||
69 | - if (length == -1 && rec_type == DST__K_MODEND) | ||
70 | + if (rec_length > maxptr - ptr) | ||
71 | + break; | ||
72 | + if (rec_type == DST__K_MODEND) | ||
73 | break; | ||
74 | |||
75 | switch (rec_type) | ||
76 | { | ||
77 | case DST__K_MODBEG: | ||
78 | + if (rec_length <= DST_S_B_MODBEG_NAME) | ||
79 | + break; | ||
80 | module->name | ||
81 | = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_MODBEG_NAME, | ||
82 | - maxptr - (ptr + DST_S_B_MODBEG_NAME)); | ||
83 | + rec_length - DST_S_B_MODBEG_NAME); | ||
84 | |||
85 | curr_pc = 0; | ||
86 | prev_pc = 0; | ||
87 | @@ -4391,13 +4395,15 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
88 | break; | ||
89 | |||
90 | case DST__K_RTNBEG: | ||
91 | + if (rec_length <= DST_S_B_RTNBEG_NAME) | ||
92 | + break; | ||
93 | funcinfo = (struct funcinfo *) | ||
94 | bfd_zalloc (abfd, sizeof (struct funcinfo)); | ||
95 | if (!funcinfo) | ||
96 | return false; | ||
97 | funcinfo->name | ||
98 | = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_RTNBEG_NAME, | ||
99 | - maxptr - (ptr + DST_S_B_RTNBEG_NAME)); | ||
100 | + rec_length - DST_S_B_RTNBEG_NAME); | ||
101 | funcinfo->low = bfd_getl32 (ptr + DST_S_L_RTNBEG_ADDRESS); | ||
102 | funcinfo->next = module->func_table; | ||
103 | module->func_table = funcinfo; | ||
104 | @@ -4407,6 +4413,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
105 | break; | ||
106 | |||
107 | case DST__K_RTNEND: | ||
108 | + if (rec_length < DST_S_L_RTNEND_SIZE + 4) | ||
109 | + break; | ||
110 | if (!module->func_table) | ||
111 | return false; | ||
112 | module->func_table->high = module->func_table->low | ||
113 | @@ -4439,10 +4447,63 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
114 | |||
115 | vms_debug2 ((3, "source info\n")); | ||
116 | |||
117 | - while (src_ptr < ptr + rec_length) | ||
118 | + while (src_ptr - ptr < rec_length) | ||
119 | { | ||
120 | int cmd = src_ptr[0], cmd_length, data; | ||
121 | |||
122 | + switch (cmd) | ||
123 | + { | ||
124 | + case DST__K_SRC_DECLFILE: | ||
125 | + if (src_ptr - ptr + DST_S_B_SRC_DF_LENGTH >= rec_length) | ||
126 | + cmd_length = 0x10000; | ||
127 | + else | ||
128 | + cmd_length = src_ptr[DST_S_B_SRC_DF_LENGTH] + 2; | ||
129 | + break; | ||
130 | + | ||
131 | + case DST__K_SRC_DEFLINES_B: | ||
132 | + cmd_length = 2; | ||
133 | + break; | ||
134 | + | ||
135 | + case DST__K_SRC_DEFLINES_W: | ||
136 | + cmd_length = 3; | ||
137 | + break; | ||
138 | + | ||
139 | + case DST__K_SRC_INCRLNUM_B: | ||
140 | + cmd_length = 2; | ||
141 | + break; | ||
142 | + | ||
143 | + case DST__K_SRC_SETFILE: | ||
144 | + cmd_length = 3; | ||
145 | + break; | ||
146 | + | ||
147 | + case DST__K_SRC_SETLNUM_L: | ||
148 | + cmd_length = 5; | ||
149 | + break; | ||
150 | + | ||
151 | + case DST__K_SRC_SETLNUM_W: | ||
152 | + cmd_length = 3; | ||
153 | + break; | ||
154 | + | ||
155 | + case DST__K_SRC_SETREC_L: | ||
156 | + cmd_length = 5; | ||
157 | + break; | ||
158 | + | ||
159 | + case DST__K_SRC_SETREC_W: | ||
160 | + cmd_length = 3; | ||
161 | + break; | ||
162 | + | ||
163 | + case DST__K_SRC_FORMFEED: | ||
164 | + cmd_length = 1; | ||
165 | + break; | ||
166 | + | ||
167 | + default: | ||
168 | + cmd_length = 2; | ||
169 | + break; | ||
170 | + } | ||
171 | + | ||
172 | + if (src_ptr - ptr + cmd_length > rec_length) | ||
173 | + break; | ||
174 | + | ||
175 | switch (cmd) | ||
176 | { | ||
177 | case DST__K_SRC_DECLFILE: | ||
178 | @@ -4467,7 +4528,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
179 | |||
180 | module->file_table [fileid].name = filename; | ||
181 | module->file_table [fileid].srec = 1; | ||
182 | - cmd_length = src_ptr[DST_S_B_SRC_DF_LENGTH] + 2; | ||
183 | vms_debug2 ((4, "DST_S_C_SRC_DECLFILE: %d, %s\n", | ||
184 | fileid, module->file_table [fileid].name)); | ||
185 | } | ||
186 | @@ -4484,7 +4544,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
187 | srec->sfile = curr_srec->sfile; | ||
188 | curr_srec->next = srec; | ||
189 | curr_srec = srec; | ||
190 | - cmd_length = 2; | ||
191 | vms_debug2 ((4, "DST_S_C_SRC_DEFLINES_B: %d\n", data)); | ||
192 | break; | ||
193 | |||
194 | @@ -4499,14 +4558,12 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
195 | srec->sfile = curr_srec->sfile; | ||
196 | curr_srec->next = srec; | ||
197 | curr_srec = srec; | ||
198 | - cmd_length = 3; | ||
199 | vms_debug2 ((4, "DST_S_C_SRC_DEFLINES_W: %d\n", data)); | ||
200 | break; | ||
201 | |||
202 | case DST__K_SRC_INCRLNUM_B: | ||
203 | data = src_ptr[DST_S_B_SRC_UNSBYTE]; | ||
204 | curr_srec->line += data; | ||
205 | - cmd_length = 2; | ||
206 | vms_debug2 ((4, "DST_S_C_SRC_INCRLNUM_B: %d\n", data)); | ||
207 | break; | ||
208 | |||
209 | @@ -4514,21 +4571,18 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
210 | data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); | ||
211 | curr_srec->sfile = data; | ||
212 | curr_srec->srec = module->file_table[data].srec; | ||
213 | - cmd_length = 3; | ||
214 | vms_debug2 ((4, "DST_S_C_SRC_SETFILE: %d\n", data)); | ||
215 | break; | ||
216 | |||
217 | case DST__K_SRC_SETLNUM_L: | ||
218 | data = bfd_getl32 (src_ptr + DST_S_L_SRC_UNSLONG); | ||
219 | curr_srec->line = data; | ||
220 | - cmd_length = 5; | ||
221 | vms_debug2 ((4, "DST_S_C_SRC_SETLNUM_L: %d\n", data)); | ||
222 | break; | ||
223 | |||
224 | case DST__K_SRC_SETLNUM_W: | ||
225 | data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); | ||
226 | curr_srec->line = data; | ||
227 | - cmd_length = 3; | ||
228 | vms_debug2 ((4, "DST_S_C_SRC_SETLNUM_W: %d\n", data)); | ||
229 | break; | ||
230 | |||
231 | @@ -4536,7 +4590,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
232 | data = bfd_getl32 (src_ptr + DST_S_L_SRC_UNSLONG); | ||
233 | curr_srec->srec = data; | ||
234 | module->file_table[curr_srec->sfile].srec = data; | ||
235 | - cmd_length = 5; | ||
236 | vms_debug2 ((4, "DST_S_C_SRC_SETREC_L: %d\n", data)); | ||
237 | break; | ||
238 | |||
239 | @@ -4544,19 +4597,16 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
240 | data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); | ||
241 | curr_srec->srec = data; | ||
242 | module->file_table[curr_srec->sfile].srec = data; | ||
243 | - cmd_length = 3; | ||
244 | vms_debug2 ((4, "DST_S_C_SRC_SETREC_W: %d\n", data)); | ||
245 | break; | ||
246 | |||
247 | case DST__K_SRC_FORMFEED: | ||
248 | - cmd_length = 1; | ||
249 | vms_debug2 ((4, "DST_S_C_SRC_FORMFEED\n")); | ||
250 | break; | ||
251 | |||
252 | default: | ||
253 | _bfd_error_handler (_("unknown source command %d"), | ||
254 | cmd); | ||
255 | - cmd_length = 2; | ||
256 | break; | ||
257 | } | ||
258 | |||
259 | @@ -4569,18 +4619,114 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
260 | |||
261 | vms_debug2 ((3, "line info\n")); | ||
262 | |||
263 | - while (pcl_ptr < ptr + rec_length) | ||
264 | + while (pcl_ptr - ptr < rec_length) | ||
265 | { | ||
266 | /* The command byte is signed so we must sign-extend it. */ | ||
267 | int cmd = ((signed char *)pcl_ptr)[0], cmd_length, data; | ||
268 | |||
269 | + switch (cmd) | ||
270 | + { | ||
271 | + case DST__K_DELTA_PC_W: | ||
272 | + cmd_length = 3; | ||
273 | + break; | ||
274 | + | ||
275 | + case DST__K_DELTA_PC_L: | ||
276 | + cmd_length = 5; | ||
277 | + break; | ||
278 | + | ||
279 | + case DST__K_INCR_LINUM: | ||
280 | + cmd_length = 2; | ||
281 | + break; | ||
282 | + | ||
283 | + case DST__K_INCR_LINUM_W: | ||
284 | + cmd_length = 3; | ||
285 | + break; | ||
286 | + | ||
287 | + case DST__K_INCR_LINUM_L: | ||
288 | + cmd_length = 5; | ||
289 | + break; | ||
290 | + | ||
291 | + case DST__K_SET_LINUM_INCR: | ||
292 | + cmd_length = 2; | ||
293 | + break; | ||
294 | + | ||
295 | + case DST__K_SET_LINUM_INCR_W: | ||
296 | + cmd_length = 3; | ||
297 | + break; | ||
298 | + | ||
299 | + case DST__K_RESET_LINUM_INCR: | ||
300 | + cmd_length = 1; | ||
301 | + break; | ||
302 | + | ||
303 | + case DST__K_BEG_STMT_MODE: | ||
304 | + cmd_length = 1; | ||
305 | + break; | ||
306 | + | ||
307 | + case DST__K_END_STMT_MODE: | ||
308 | + cmd_length = 1; | ||
309 | + break; | ||
310 | + | ||
311 | + case DST__K_SET_LINUM_B: | ||
312 | + cmd_length = 2; | ||
313 | + break; | ||
314 | + | ||
315 | + case DST__K_SET_LINUM: | ||
316 | + cmd_length = 3; | ||
317 | + break; | ||
318 | + | ||
319 | + case DST__K_SET_LINUM_L: | ||
320 | + cmd_length = 5; | ||
321 | + break; | ||
322 | + | ||
323 | + case DST__K_SET_PC: | ||
324 | + cmd_length = 2; | ||
325 | + break; | ||
326 | + | ||
327 | + case DST__K_SET_PC_W: | ||
328 | + cmd_length = 3; | ||
329 | + break; | ||
330 | + | ||
331 | + case DST__K_SET_PC_L: | ||
332 | + cmd_length = 5; | ||
333 | + break; | ||
334 | + | ||
335 | + case DST__K_SET_STMTNUM: | ||
336 | + cmd_length = 2; | ||
337 | + break; | ||
338 | + | ||
339 | + case DST__K_TERM: | ||
340 | + cmd_length = 2; | ||
341 | + break; | ||
342 | + | ||
343 | + case DST__K_TERM_W: | ||
344 | + cmd_length = 3; | ||
345 | + break; | ||
346 | + | ||
347 | + case DST__K_TERM_L: | ||
348 | + cmd_length = 5; | ||
349 | + break; | ||
350 | + | ||
351 | + case DST__K_SET_ABS_PC: | ||
352 | + cmd_length = 5; | ||
353 | + break; | ||
354 | + | ||
355 | + default: | ||
356 | + if (cmd <= 0) | ||
357 | + cmd_length = 1; | ||
358 | + else | ||
359 | + cmd_length = 2; | ||
360 | + break; | ||
361 | + } | ||
362 | + | ||
363 | + if (pcl_ptr - ptr + cmd_length > rec_length) | ||
364 | + break; | ||
365 | + | ||
366 | switch (cmd) | ||
367 | { | ||
368 | case DST__K_DELTA_PC_W: | ||
369 | data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); | ||
370 | curr_pc += data; | ||
371 | curr_linenum += 1; | ||
372 | - cmd_length = 3; | ||
373 | vms_debug2 ((4, "DST__K_DELTA_PC_W: %d\n", data)); | ||
374 | break; | ||
375 | |||
376 | @@ -4588,131 +4734,111 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
377 | data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); | ||
378 | curr_pc += data; | ||
379 | curr_linenum += 1; | ||
380 | - cmd_length = 5; | ||
381 | vms_debug2 ((4, "DST__K_DELTA_PC_L: %d\n", data)); | ||
382 | break; | ||
383 | |||
384 | case DST__K_INCR_LINUM: | ||
385 | data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; | ||
386 | curr_linenum += data; | ||
387 | - cmd_length = 2; | ||
388 | vms_debug2 ((4, "DST__K_INCR_LINUM: %d\n", data)); | ||
389 | break; | ||
390 | |||
391 | case DST__K_INCR_LINUM_W: | ||
392 | data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); | ||
393 | curr_linenum += data; | ||
394 | - cmd_length = 3; | ||
395 | vms_debug2 ((4, "DST__K_INCR_LINUM_W: %d\n", data)); | ||
396 | break; | ||
397 | |||
398 | case DST__K_INCR_LINUM_L: | ||
399 | data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); | ||
400 | curr_linenum += data; | ||
401 | - cmd_length = 5; | ||
402 | vms_debug2 ((4, "DST__K_INCR_LINUM_L: %d\n", data)); | ||
403 | break; | ||
404 | |||
405 | case DST__K_SET_LINUM_INCR: | ||
406 | _bfd_error_handler | ||
407 | (_("%s not implemented"), "DST__K_SET_LINUM_INCR"); | ||
408 | - cmd_length = 2; | ||
409 | break; | ||
410 | |||
411 | case DST__K_SET_LINUM_INCR_W: | ||
412 | _bfd_error_handler | ||
413 | (_("%s not implemented"), "DST__K_SET_LINUM_INCR_W"); | ||
414 | - cmd_length = 3; | ||
415 | break; | ||
416 | |||
417 | case DST__K_RESET_LINUM_INCR: | ||
418 | _bfd_error_handler | ||
419 | (_("%s not implemented"), "DST__K_RESET_LINUM_INCR"); | ||
420 | - cmd_length = 1; | ||
421 | break; | ||
422 | |||
423 | case DST__K_BEG_STMT_MODE: | ||
424 | _bfd_error_handler | ||
425 | (_("%s not implemented"), "DST__K_BEG_STMT_MODE"); | ||
426 | - cmd_length = 1; | ||
427 | break; | ||
428 | |||
429 | case DST__K_END_STMT_MODE: | ||
430 | _bfd_error_handler | ||
431 | (_("%s not implemented"), "DST__K_END_STMT_MODE"); | ||
432 | - cmd_length = 1; | ||
433 | break; | ||
434 | |||
435 | case DST__K_SET_LINUM_B: | ||
436 | data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; | ||
437 | curr_linenum = data; | ||
438 | - cmd_length = 2; | ||
439 | vms_debug2 ((4, "DST__K_SET_LINUM_B: %d\n", data)); | ||
440 | break; | ||
441 | |||
442 | case DST__K_SET_LINUM: | ||
443 | data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); | ||
444 | curr_linenum = data; | ||
445 | - cmd_length = 3; | ||
446 | vms_debug2 ((4, "DST__K_SET_LINE_NUM: %d\n", data)); | ||
447 | break; | ||
448 | |||
449 | case DST__K_SET_LINUM_L: | ||
450 | data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); | ||
451 | curr_linenum = data; | ||
452 | - cmd_length = 5; | ||
453 | vms_debug2 ((4, "DST__K_SET_LINUM_L: %d\n", data)); | ||
454 | break; | ||
455 | |||
456 | case DST__K_SET_PC: | ||
457 | _bfd_error_handler | ||
458 | (_("%s not implemented"), "DST__K_SET_PC"); | ||
459 | - cmd_length = 2; | ||
460 | break; | ||
461 | |||
462 | case DST__K_SET_PC_W: | ||
463 | _bfd_error_handler | ||
464 | (_("%s not implemented"), "DST__K_SET_PC_W"); | ||
465 | - cmd_length = 3; | ||
466 | break; | ||
467 | |||
468 | case DST__K_SET_PC_L: | ||
469 | _bfd_error_handler | ||
470 | (_("%s not implemented"), "DST__K_SET_PC_L"); | ||
471 | - cmd_length = 5; | ||
472 | break; | ||
473 | |||
474 | case DST__K_SET_STMTNUM: | ||
475 | _bfd_error_handler | ||
476 | (_("%s not implemented"), "DST__K_SET_STMTNUM"); | ||
477 | - cmd_length = 2; | ||
478 | break; | ||
479 | |||
480 | case DST__K_TERM: | ||
481 | data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; | ||
482 | curr_pc += data; | ||
483 | - cmd_length = 2; | ||
484 | vms_debug2 ((4, "DST__K_TERM: %d\n", data)); | ||
485 | break; | ||
486 | |||
487 | case DST__K_TERM_W: | ||
488 | data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); | ||
489 | curr_pc += data; | ||
490 | - cmd_length = 3; | ||
491 | vms_debug2 ((4, "DST__K_TERM_W: %d\n", data)); | ||
492 | break; | ||
493 | |||
494 | case DST__K_TERM_L: | ||
495 | data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); | ||
496 | curr_pc += data; | ||
497 | - cmd_length = 5; | ||
498 | vms_debug2 ((4, "DST__K_TERM_L: %d\n", data)); | ||
499 | break; | ||
500 | |||
501 | case DST__K_SET_ABS_PC: | ||
502 | data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); | ||
503 | curr_pc = data; | ||
504 | - cmd_length = 5; | ||
505 | vms_debug2 ((4, "DST__K_SET_ABS_PC: 0x%x\n", data)); | ||
506 | break; | ||
507 | |||
508 | @@ -4721,15 +4847,11 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, | ||
509 | { | ||
510 | curr_pc -= cmd; | ||
511 | curr_linenum += 1; | ||
512 | - cmd_length = 1; | ||
513 | vms_debug2 ((4, "bump pc to 0x%lx and line to %d\n", | ||
514 | (unsigned long)curr_pc, curr_linenum)); | ||
515 | } | ||
516 | else | ||
517 | - { | ||
518 | - _bfd_error_handler (_("unknown line command %d"), cmd); | ||
519 | - cmd_length = 2; | ||
520 | - } | ||
521 | + _bfd_error_handler (_("unknown line command %d"), cmd); | ||
522 | break; | ||
523 | } | ||
524 | |||
525 | @@ -4859,7 +4981,8 @@ build_module_list (bfd *abfd) | ||
526 | return NULL; | ||
527 | |||
528 | module = new_module (abfd); | ||
529 | - if (!parse_module (abfd, module, PRIV (dst_section)->contents, -1)) | ||
530 | + if (!parse_module (abfd, module, PRIV (dst_section)->contents, | ||
531 | + PRIV (dst_section)->size)) | ||
532 | return NULL; | ||
533 | list = module; | ||
534 | } | ||