tools: address possible non-null terminated filenames
If a filename is a multiple of 18 characters, there will be no null-terminator.
This will result in an invalid access by the constructed StringRef. Add a test
case to exercise this and fix that handling. Address this same vulnerability in
llvm-readobj as well.
llvm-svn: 206145
diff --git a/llvm/tools/llvm-objdump/llvm-objdump.cpp b/llvm/tools/llvm-objdump/llvm-objdump.cpp
index 313816e..8d5035e 100644
--- a/llvm/tools/llvm-objdump/llvm-objdump.cpp
+++ b/llvm/tools/llvm-objdump/llvm-objdump.cpp
@@ -669,17 +669,7 @@
const coff_symbol *symbol = 0;
for (int i = 0, e = header->NumberOfSymbols; i != e; ++i) {
if (aux_count--) {
- switch (symbol->StorageClass) {
- default: outs() << "AUX Unknown\n";
- case COFF::IMAGE_SYM_CLASS_STATIC:
- // Section definition. Follows a symbol-table record that defines a
- // section. Such a record has a symbol name that is the name of a
- // section and has storage class STATIC (3).
- if (symbol->Value) {
- errs() << "invalid entry in Symbol Table";
- break;
- }
-
+ if (symbol->isSectionDefinition()) {
const coff_aux_section_definition *asd;
if (error(coff->getAuxSymbol<coff_aux_section_definition>(i, asd)))
return;
@@ -693,15 +683,17 @@
<< format("assoc %d comdat %d\n"
, unsigned(asd->Number)
, unsigned(asd->Selection));
- break;
- case COFF::IMAGE_SYM_CLASS_FILE:
+ } else if (symbol->isFileRecord()) {
const coff_aux_file *AF;
if (error(coff->getAuxSymbol<coff_aux_file>(i, AF)))
return;
- outs() << "AUX " << StringRef(AF->FileName) << '\n';
+
+ StringRef Name(AF->FileName, (aux_count + 1) * COFF::SymbolSize);
+ outs() << "AUX " << Name.rtrim(StringRef("\0", 1)) << '\n';
i = i + aux_count;
aux_count = 0;
- break;
+ } else {
+ outs() << "AUX Unknown\n";
}
} else {
StringRef name;