Skip to content

Commit 714cd7b

Browse files
committed
gas .file sanity check
Currently we allow insane file numbers that cause gas to allocate up to 4G of memory for a file array. Trim that a little to 1G (which still allows insane file numbers up to 33554431), and tidy function parameter types so that we only need one file number sanity check. * dwarf2dbg.c (assign_file_to_slot): Take a valueT file number. Reduce max files array size. (allocate_filename_to_slot): Take a valueT file number. (dwarf2_directive_filename): Don't duplicate file number sanity check here.
1 parent 3222bea commit 714cd7b

File tree

1 file changed

+11
-19
lines changed

1 file changed

+11
-19
lines changed

gas/dwarf2dbg.c

Lines changed: 11 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -678,18 +678,17 @@ get_directory_table_entry (const char *dirname,
678678
}
679679

680680
static bool
681-
assign_file_to_slot (unsigned int i, const char *file, unsigned int dir)
681+
assign_file_to_slot (valueT i, const char *file, unsigned int dir)
682682
{
683683
if (i >= files_allocated)
684684
{
685685
unsigned int want = i + 32;
686686

687-
/* Catch wraparound. */
688-
if (want < files_allocated
689-
|| want < i
690-
|| want > UINT_MAX / sizeof (struct file_entry))
687+
/* If this array is taking 1G or more, someone is using silly
688+
file numbers. */
689+
if (want < i || want > UINT_MAX / 4 / sizeof (struct file_entry))
691690
{
692-
as_bad (_("file number %u is too big"), i);
691+
as_bad (_("file number %" PRIu64 " is too big"), (uint64_t) i);
693692
return false;
694693
}
695694

@@ -843,7 +842,7 @@ purge_generated_debug (bool thelot)
843842
static bool
844843
allocate_filename_to_slot (const char *dirname,
845844
const char *filename,
846-
unsigned int num,
845+
valueT num,
847846
bool with_md5)
848847
{
849848
const char *file;
@@ -921,8 +920,9 @@ allocate_filename_to_slot (const char *dirname,
921920
}
922921

923922
fail:
924-
as_bad (_("file table slot %u is already occupied by a different file (%s%s%s vs %s%s%s)"),
925-
num,
923+
as_bad (_("file table slot %u is already occupied by a different file"
924+
" (%s%s%s vs %s%s%s)"),
925+
(unsigned int) num,
926926
dir == NULL ? "" : dir,
927927
dir == NULL ? "" : "/",
928928
files[num].filename,
@@ -968,7 +968,7 @@ allocate_filename_to_slot (const char *dirname,
968968
d = get_directory_table_entry (dirname, file0_dirname, dirlen, num == 0);
969969
i = num;
970970

971-
if (! assign_file_to_slot (i, file, d))
971+
if (!assign_file_to_slot (num, file, d))
972972
return false;
973973

974974
if (with_md5)
@@ -1228,15 +1228,7 @@ dwarf2_directive_filename (void)
12281228
purge_generated_debug (false);
12291229
debug_type = DEBUG_NONE;
12301230

1231-
if (num != (unsigned int) num
1232-
|| num >= (size_t) -1 / sizeof (struct file_entry) - 32)
1233-
{
1234-
as_bad (_("file number %lu is too big"), (unsigned long) num);
1235-
return NULL;
1236-
}
1237-
1238-
if (! allocate_filename_to_slot (dirname, filename, (unsigned int) num,
1239-
with_md5))
1231+
if (!allocate_filename_to_slot (dirname, filename, num, with_md5))
12401232
return NULL;
12411233

12421234
return filename;

0 commit comments

Comments
 (0)