Skip to content

Commit 891c63e

Browse files
SweetVishnyaH. Peter Anvin
authored andcommitted
output: fix null pointer dereferences in output/outaout.c
The bugs were found by Svace static analysis tool: 1. sym can be null in when exact is false, and sym is later dereferenced by sym->symnum 2. asym can be null, no return from function is performed, and asym is dereferenced by asym->symnum
1 parent bd7185b commit 891c63e

File tree

1 file changed

+13
-6
lines changed

1 file changed

+13
-6
lines changed

output/outaout.c

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,11 @@ static int32_t aout_add_gsym_reloc(struct Section *sect,
466466
list_for_each(sym, shead)
467467
if (sym->value == offset)
468468
break;
469+
if (!sym) {
470+
nasm_nonfatal("unable to find a suitable global symbol"
471+
" for this reference");
472+
return 0;
473+
}
469474
} else {
470475
/*
471476
* Find the nearest symbol below this one.
@@ -474,11 +479,11 @@ static int32_t aout_add_gsym_reloc(struct Section *sect,
474479
list_for_each(sm, shead)
475480
if (sm->value <= offset && (!sym || sm->value > sym->value))
476481
sym = sm;
477-
}
478-
if (!sym && exact) {
479-
nasm_nonfatal("unable to find a suitable global symbol"
480-
" for this reference");
481-
return 0;
482+
if (!sym) {
483+
nasm_nonfatal("unable to find a suitable nearest symbol"
484+
" below this reference");
485+
return 0;
486+
}
482487
}
483488

484489
r = *sect->tail = nasm_malloc(sizeof(struct Reloc));
@@ -522,9 +527,11 @@ static int32_t aout_add_gotoff_reloc(struct Section *sect, int32_t segment,
522527
asym = sdata.asym;
523528
else if (segment == sbss.index)
524529
asym = sbss.asym;
525-
if (!asym)
530+
if (!asym) {
526531
nasm_nonfatal("`..gotoff' relocations require a non-global"
527532
" symbol in the section");
533+
return 0;
534+
}
528535

529536
r = *sect->tail = nasm_malloc(sizeof(struct Reloc));
530537
sect->tail = &r->next;

0 commit comments

Comments
 (0)