Fixes lots of places the fuzzers are going to find, and the one they
already hit.
* mach-o.c (bfd_mach_o_read_dylinker): Don't read past end of
command. Check name offset is within command.
(bfd_mach_o_read_dylib, bfd_mach_o_read_prebound_dylib),
(bfd_mach_o_read_prebind_cksum, bfd_mach_o_read_twolevel_hints),
(bfd_mach_o_read_fvmlib, bfd_mach_o_read_dysymtab),
(bfd_mach_o_read_symtab, bfd_mach_o_read_uuid),
(bfd_mach_o_read_linkedit, bfd_mach_o_read_str),
(bfd_mach_o_read_dyld_info, bfd_mach_o_read_version_min),
(bfd_mach_o_read_encryption_info, bfd_mach_o_read_source_version),
(bfd_mach_o_read_encryption_info_64, bfd_mach_o_read_main),
(bfd_mach_o_read_note, bfd_mach_o_read_build_version),
(bfd_mach_o_read_segment): Similarly.
(bfd_mach_o_read_thread): Properly bound check thread struct.
Don't repeat checks on second loop.
(bfd_mach_o_read_command): Fail on invalid command length.
It's a little tricky. We can release any memory back when we have a
match failure, but after a match success which we might want to
preserve for later use the high water mark must change to that of the
matched bfd.
* format.c (bfd_check_format_matches): Add preserve_match.
Save initial bfd state in "preserve", matched bfd state in
"preserve_match". Save just the first match. Release
bfd_alloc memory. Restore and finish preserved state as
appropriate on all function exit paths.
object_p functions cannot allocate memory by malloc and not free it
before returning. Even a successful target match may not be the best
match. If a match isn't used then those malloc'd blocks won't be
freed.
* coffgen.c (coff_real_object_p): Free malloc'd memory on target
match too.
PR 25307
(bfd_pef_parse_function_stubs): Correct the test that ensures that
there is enough data remaining in the code buffer before
attempting to read a function stub.
ld/PR25316
* elfnn-ia64.c (elfNN_ia64_merge_private_bfd_data): don't fail
on binary inputs ld/PR25316.
(is_ia64_elf): new helper to filter on ia64 objects.
PR 25224
bfd * Makefile.am: Add z80-elf target support.
* configure.ac: Likewise.
* targets.c: Likewise.
* config.bfd: Add z80-elf target support and new arches: ez80 and z180.
* elf32-z80.c: New file.
* archures.c: Add new z80 architectures: eZ80 and Z180.
* coffcode.h: Likewise.
* cpu-z80.c: Likewise.
* bfd-in2.h: Likewise plus additional Z80 relocations.
* coff-z80.c: Add new relocations for Z80 target and local label check.
gas * config/tc-z80.c: Add new architectures: Z180 and eZ80. Add support
for assembler code generated by SDCC. Add new relocation types. Add
z80-elf target support.
* config/tc-z80.h: Add z80-elf target support. Enable dollar local
labels. Local labels starts from ".L".
* testsuite/gas/all/fwdexp.d: Fix failure due to symbol conflict.
* testsuite/gas/all/fwdexp.s: Likewise.
* testsuite/gas/z80/suffix.d: Fix failure on ELF target.
* testsuite/gas/z80/z80.exp: Add new tests
* testsuite/gas/z80/dollar.d: New file.
* testsuite/gas/z80/dollar.s: New file.
* testsuite/gas/z80/ez80_adl_all.d: New file.
* testsuite/gas/z80/ez80_adl_all.s: New file.
* testsuite/gas/z80/ez80_adl_suf.d: New file.
* testsuite/gas/z80/ez80_isuf.s: New file.
* testsuite/gas/z80/ez80_z80_all.d: New file.
* testsuite/gas/z80/ez80_z80_all.s: New file.
* testsuite/gas/z80/ez80_z80_suf.d: New file.
* testsuite/gas/z80/r800_extra.d: New file.
* testsuite/gas/z80/r800_extra.s: New file.
* testsuite/gas/z80/r800_ii8.d: New file.
* testsuite/gas/z80/r800_z80_doc.d: New file.
* testsuite/gas/z80/z180.d: New file.
* testsuite/gas/z80/z180.s: New file.
* testsuite/gas/z80/z180_z80_doc.d: New file.
* testsuite/gas/z80/z80_doc.d: New file.
* testsuite/gas/z80/z80_doc.s: New file.
* testsuite/gas/z80/z80_ii8.d: New file.
* testsuite/gas/z80/z80_ii8.s: New file.
* testsuite/gas/z80/z80_in_f_c.d: New file.
* testsuite/gas/z80/z80_in_f_c.s: New file.
* testsuite/gas/z80/z80_op_ii_ld.d: New file.
* testsuite/gas/z80/z80_op_ii_ld.s: New file.
* testsuite/gas/z80/z80_out_c_0.d: New file.
* testsuite/gas/z80/z80_out_c_0.s: New file.
* testsuite/gas/z80/z80_reloc.d: New file.
* testsuite/gas/z80/z80_reloc.s: New file.
* testsuite/gas/z80/z80_sli.d: New file.
* testsuite/gas/z80/z80_sli.s: New file.
ld * Makefile.am: Add new target z80-elf
* configure.tgt: Likewise.
* emultempl/z80.em: Add support for eZ80 and Z180 architectures.
* emulparams/elf32z80.sh: New file.
* emultempl/z80elf.em: Likewise.
* testsuite/ld-z80/arch_ez80_adl.d: Likewise.
* testsuite/ld-z80/arch_ez80_z80.d: Likewise.
* testsuite/ld-z80/arch_r800.d: Likewise.
* testsuite/ld-z80/arch_z180.d: Likewise.
* testsuite/ld-z80/arch_z80.d: Likewise.
* testsuite/ld-z80/comb_arch_ez80_z80.d: Likewise.
* testsuite/ld-z80/comb_arch_z180.d: Likewise.
* testsuite/ld-z80/labels.s: Likewise.
* testsuite/ld-z80/relocs.s: Likewise.
* testsuite/ld-z80/relocs_b_ez80.d: Likewise.
* testsuite/ld-z80/relocs_b_z80.d: Likewise.
* testsuite/ld-z80/relocs_f_z80.d: Likewise.
* testsuite/ld-z80/z80.exp: Likewise.
opcodes * z80-dis.c: Add support for eZ80 and Z80 instructions.
This fixes PR 25210 by specifying the the correct ELF class for AArch64 stubs.
After doing this the stub section starts behaving like a normal object file
loaded from disk. That is SEC_LINKER_CREATED causes us to have to write the
section manually.
This flag was added as a fix for PR 24753. I believe that
fix to still be correct as linker created sections don't have a size on disk
and it fixes the Arm bootstrap regression. But in this case specifying the
correct section class also makes the stub section not be considered by
compress.c.
So I'm partially revert this change so that we don't have to manage the section
manually as implied by SEC_LINKER_CREATED.
bfd/ChangeLog:
PR 25210
PR 24753
* elfnn-aarch64.c (_bfd_aarch64_create_stub_section): Set ELF class.
ld/ChangeLog:
PR 25210
PR 24753
* emultempl/aarch64elf.em (elf${ELFSIZE}_aarch64_add_stub_section):
Remove SEC_LINKER_CREATED.
* testsuite/ld-aarch64/aarch64-elf.exp: Add erratum835769-843419.
* testsuite/ld-aarch64/erratum835769-843419.d: New test.
This fixes yet more errors in the alpha-vms buffer size checks.
* vms-alpha.c (_bfd_vms_slurp_eisd): Don't overflow when checking
offset. Don't overflow when checking rec_size, and do allow
rec_size to the end of the buffer. Ensure eisd->type can be
accessed, not just the first 32 bytes. Don't call
_bfd_vms_save_counted_string with zero length remaining. Fail
on empty string section name.
(_bfd_vms_slurp_egsd): Formatting. Catch more reads past end
of record size. Correct remaining length calculation. Fail
on empty string section name. Consolidate error paths.
Quite a few bfd_zalloc calls are wasting time clearing memory, and
should be bfd_alloc instead.
* archive.c (do_slurp_bsd_armap): Use bfd_alloc rather than
bfd_zalloc when memory is all written after the call.
(do_slurp_coff_armap): Likewise. Set bfd_error on ridiculously
large allocations that overflow bfd_size_type. Use just one
bfd_release on error exit.
(_bfd_slurp_extended_name_table): Use bfd_alloc for extended_names,
clear last byte rather than the entire array. Use bfd_alloc for
string table. Rearrange and simplify code copying file names.
* vms-alpha.c (_bfd_vms_slurp_egsd): Make base_addr a bfd_vma.
Limit alignment power. Correct and simplify alignment expression.
(evax_bfd_print_relocation_records): Avoid signed shift left.
Triggered by overflow of size calulation resulting in a too small
buffer. The testcase found one of the som_bfd_count_ar_symbols
problems.
* som.c (setup_sections): Don't overflow space_strings_size. Use
bfd_malloc2 to catch overflow of size calculation.
(som_prep_for_fixups): Use bfd_zalloc2 to catch overflow of size
calculation.
(som_build_and_write_symbol_table): Similarly use bfd_zmalloc2.
(som_slurp_symbol_table): Similarly use bfd_zmalloc2, bfd_malloc2,
and bfd_zalloc2.
(bfd_som_attach_aux_hdr): Use size_t vars for string length.
(som_bfd_count_ar_symbols): Use bfd_malloc2 to catch overflow of
size calculation. Use size_t vars for length and catch overflow.
(som_slurp_armap): Use bfd_alloc2 to catch overflow of size
calculation.
(som_bfd_ar_write_symbol_stuff): Similarly use bfd_zmalloc2 and
bfd_malloc2. Perform size calculations in bfd_size_type.
Two buffer overflows, and some over restrictive length checks.
* vms-alpha.c (add_symbol): Add "max" parameter. Error on string
length larger than max.
(_bfd_vms_slurp_egsd): Ensure record is at least large enough to
read string length byte, error if not. Pass size to add_symbol.
(_bfd_vms_slurp_etir): Don't read past end of buffer when reading
type and length. Allow read of last byte in buffer.
"count * 8 >= size" might overflow, "count >= size / 8" doesn't.
* coff-rs6000.c (_bfd_xcoff_slurp_armap): Don't overflow when
checking symbol count against section size. Guard against strlen
running off end of buffer by allocating one more byte and zeroing.
* coff64-rs6000.c (xcoff64_slurp_armap): Likewise.
This is fussing about nothing really but since I was looking at signed
vs. unsigned issues, I decided to use the correct types here.
* elf32-ppc.c (ppc_elf_get_synthetic_symtab): Use size_t for vars.
* elf64-ppc.c (sym_exists_at): Use size_t for lo, hi and mid.
PR 25237
* elf.c (assign_file_positions_for_load_sections): Attempt to
keep meaningless p_offset for PT_LOAD segments without file
contents within file size.
In Operand_soffsetx4_decode:
soffsetx4_0 = 0x4 + ((((int) offset_0 << 14) >> 14) << 2);
and other places.
Don't sign extend with shifts! This file also has many occurrences of
truncation via shifts, which aren't a problem due to using uint32, but
I dislike on principle enough to fix.
* xtensa-modules.c (Field_* functions): Don't mask using shifts.
(Operand_soffsetx4_decode, Operand_simm4_decode),
(Operand_simm8_decode, Operand_simm8x256_decode),
(Operand_simm12b_decode, Operand_label8_decode),
(Operand_label12_decode, Operand_soffset_decode),
(Operand_xt_wbr15_label_decode, Operand_xt_wbr18_label_decode): Don't
sign extend using shifts.
(Operand_immrx4_decode, Operand_uimm16x4_decode): Avoid UB in
constant.
Here, since val is signed:
*valuep = (val << scale);
* cpu-ia64-opc.c (ext_imms_scaled): Avoid undefined left shift
of negative values by using unsigned vars.
In cases where a relocatable object file has a common symbol, no other
file has a definition, and there is a matching common symbol found in
a shared library then ld will output a definition using the largest of
size and alignment for the commons. This patch fixes a bug in ld that
ignored common symbols when assigning versions, resulting in such
symbols being given VER_NDX_LOCAL versions.
PR 25236
* elflink.c (_bfd_elf_link_assign_sym_version): Assign versions
for ELF_COMMON_DEF_P symbols.
(elf_link_output_extsym, _bfd_elf_add_default_symbol): Adjust to
suit.
This bug was observed on nios2-linux-gnu with some C++ programs
linked with -pie or -shared. The nios2 ABI doesn't include appropriate
relocations in this instance and GCC is also being patched not to pass
--eh-frame-hdr to the linker in those cases.
2019-12-05 Sandra Loosemore <sandra@codesourcery.com>
bfd/
* elf-eh-frame.c (_bfd_elf_discard_section_eh_frame): Make
FDE encoding warning conditional.
This patch remedies the following DW_FORM_GNU_ref_alt related problem:
/* FIXME: Do we need to locate the correct CU, in a similar
fashion to the code in the DW_FORM_ref_addr case above ? */
Without the correct CU the wrong abbrevs are used, resulting in
errors and/or wrong file names.
There is scope for further work here. Parsing of CUs should be a two
step process, with the first stage just finding the bounds of the CU.
This would allow find_abstract_instance to quickly find the CU
referenced by DW_FORM_ref_addr or DW_FORM_GNU_ref_alt, then take the
second stage of CU parsing where abbrevs, ranges and suchlike consume
time and memory. As it is, we just process CUs from the start of
.debug_info until we find the one of interest. The testcase in the PR
takes 98G of virtual memory.
PR 25230
* dwarf2.c (struct dwarf2_debug_file): Add line_table and
abbrev_offsets.
(struct abbrev_offset_entry): New.
(hash_abbrev, eq_abbrev, del_abbrev): New functions.
(read_abbrevs): Check whether we have already read abbrevs at
given offset, and add new offset/abbrev to hash table.
(decode_line_info): Keep line table at offset zero in file struct.
Return this for a cu reusing the same dir/file list.
(find_abstract_instance): Find cu for DW_FORM_GNU_ref_alt.
(_bfd_dwarf2_slurp_debug_info): Create offset/abbrev hash tables.
(_bfd_dwarf2_cleanup_debug_info): Adjust deletion of lines and
abbrevs.
read_section does offset checking, reporting an error on out of
bounds. There's no need to duplicate the check in functions calling
read_section. Also, I spotted a place where a pointer difference
expression was being cast to unsigned int, possibly truncating
relevant bits on a 64-bit host.
* dwarf2.c (read_indirect_string): Don't duplicate offset check
done in read_section.
(read_indirect_line_string): Likewise.
(read_alt_indirect_string): Likewise.
(read_alt_indirect_ref): Likewise.
(read_abbrevs): Likewise. Free memory on all failure paths.
Use correct unsigned type for pointer difference comparison.
These are unused. Remove them. Also fix the wrong sort of 0 being
returned from read_alt_indirect_ref.
* dwarf2.c (struct dwarf2_debug): Update comments. Remove sec
and sec_info_ptr.
(_bfd_dwarf2_slurp_debug_info): Don't set sec or sec_info_ptr.
(stash_comp_unit): Likewise.
(read_alt_indirect_ref): Return NULL not FALSE.
There were a number of problems with the previous patch. Firstly,
_bfd_dwarf2_stash_syms didn't do anything when the original file had
dynamic symbols, and secondly, info found by the symbol search didn't
make it out of _bfd_elf_find_nearest_line except in the case of DWARF
functions without external linkage.
PR 23652
* dwarf2.c (_bfd_dwarf2_stash_syms): Break out of loop on finding
matching section.
(_bfd_dwarf2_find_nearest_line): Return an int, with value 2 when
returning info from the symbol table. Do the _bfd_elf_find_function
search also when !found. Call _bfd_dwarf2_stash_syms regardless of
symbols.
* elf64-alpha.c (elf64_alpha_find_nearest_line): Accept dwarf2
result of 1 only.
* elfxx-mips.c (_bfd_mips_elf_find_nearest_line): Likewise.
* libbfd-in.h (_bfd_dwarf2_find_nearest_line): Update prototype.
* libbfd.h: Regenerate.
Sometimes DWARF info for a function is incomplete, and the function
can be retrieved by examining symbols. However, when separate debug
files are used it may be that the original file is completely
stripped of symbols. This patch teaches BFD to look at symbols from
the debug file in that case.
The patch also removes arm_elf_find_function, instead implementing
elf_backend_maybe_function_sym. arm_elf_find_function was written
before the generic _bfd_elf_find_function called maybe_function_sym.
aarch64 copied arm, so that file gets the same treatment. There is
some chance this will speed up arm and aarch64 lookup of function/line.
PR 23652
* dwarf2.c (_bfd_dwarf2_stash_syms): New function.
(_bfd_dwarf2_find_nearest_line): Use it here, passing syms to
_bfd_elf_find_function. Call _bfd_elf_find_function in cases
where _bfd_elf_find_nearest_line would do so.
* elf.c (_bfd_elf_find_nearest_line): Omit _bfd_elf_find_function
for dwarf2.
* elfxx-mips.c (_bfd_mips_elf_find_nearest_line): Similarly. Tidy.
* elf32-arm.c (elf32_arm_maybe_function_sym): New function.
(elf_backend_maybe_function_sym): Define.
(arm_elf_find_function, elf32_arm_find_nearest_line): Delete.
(bfd_elf32_find_nearest_line): Don't define.
* elfnn-aarch64.c (elfNN_aarch64_maybe_function_sym): New function.
(elf_backend_maybe_function_sym): Define.
(aarch64_elf_find_function, elfNN_aarch64_find_nearest_line): Delete.
(bfd_elfNN_find_nearest_line): Don't define.
Using bfd_vma for insn is to avoid having to worry about sign
propagation in expressions involving insn and sym_value when bfd_vma
is not the same as unsigned long.
* elf32-sh.c (sh_reloc): Use a bfd_vma insn.
(sh_reloc <R_SH_IND12W>): Divide calculated relocation value
by two before applying to insn. Correct overflow test.
* coff-sh.c (sh_reloc): Likewise.
