On Sat, 15 Oct 2011 19:33:22 +0200, Pascal Stumpf wrote: > Oh, and I just checked: This bug even is in src binutils (both 2.15 and > 2.17), just nobody noticed because -Werror isn't used there (but it > probably should be fixed there too, right?). > >
Upstream fix is here. Attached are patches for devel/gdb, devel/libbfd and base binutils 2.15 and 2.17 (permission to use under GPLv2 has been granted, thanks to nickc at redhat dot com). Index: Makefile =================================================================== RCS file: /cvs/ports/devel/libbfd/Makefile,v retrieving revision 1.6 diff -u -p -r1.6 Makefile --- Makefile 27 Sep 2011 21:38:42 -0000 1.6 +++ Makefile 25 Oct 2011 14:08:53 -0000 @@ -5,7 +5,7 @@ COMMENT= GNU Binary File Descriptor libr VER= 2.20 DISTNAME= binutils-${VER} PKGNAME= libbfd-${VER} -REVISION= 1 +REVISION= 2 EXTRACT_SUFX= .tar.bz2 HOMEPAGE= http://www.gnu.org/software/binutils/ @@ -26,8 +26,7 @@ MASTER_SITES= ${MASTER_SITE_GNU:=binutil USE_LIBTOOL= Yes LIBTOOL_FLAGS= --tag=disable-shared CONFIGURE_ARGS+= --disable-nls \ - --disable-shared \ - --disable-werror + --disable-shared WRKSRC=${WRKDIR}/${DISTNAME}/bfd Index: patches/patch-bfd_peXXigen_c =================================================================== RCS file: patches/patch-bfd_peXXigen_c diff -N patches/patch-bfd_peXXigen_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-bfd_peXXigen_c 25 Oct 2011 14:08:53 -0000 @@ -0,0 +1,22 @@ +$OpenBSD$ +fix out-of-bounds memcpys +--- bfd/peXXigen.c.orig Tue Oct 25 16:03:53 2011 ++++ bfd/peXXigen.c Tue Oct 25 16:04:25 2011 +@@ -248,7 +248,7 @@ _bfd_XXi_swap_aux_in (bfd * abfd, + in->x_file.x_n.x_offset = H_GET_32 (abfd, ext->x_file.x_n.x_offset); + } + else +- memcpy (in->x_file.x_fname, ext->x_file.x_fname, FILNMLEN); ++ memcpy (in->x_file.x_fname, ext->x_file.x_fname, sizeof in->x_file.x_fname); + return; + + case C_STAT: +@@ -322,7 +322,7 @@ _bfd_XXi_swap_aux_out (bfd * abfd, + H_PUT_32 (abfd, in->x_file.x_n.x_offset, ext->x_file.x_n.x_offset); + } + else +- memcpy (ext->x_file.x_fname, in->x_file.x_fname, FILNMLEN); ++ memcpy (ext->x_file.x_fname, in->x_file.x_fname, sizeof ext->x_file.x_fname); + + return AUXESZ; + Index: Makefile =================================================================== RCS file: /cvs/ports/devel/gdb/Makefile,v retrieving revision 1.10 diff -u -p -r1.10 Makefile --- Makefile 27 Sep 2011 20:26:45 -0000 1.10 +++ Makefile 25 Oct 2011 14:09:02 -0000 @@ -4,7 +4,7 @@ COMMENT= GNU debugger CATEGORIES= devel DISTNAME= gdb-7.2 -REVISION= 1 +REVISION= 2 MASTER_SITES= ${MASTER_SITE_GNU:=gdb/} \ http://distfiles.nl/ Index: patches/patch-bfd_peXXigen_c =================================================================== RCS file: patches/patch-bfd_peXXigen_c diff -N patches/patch-bfd_peXXigen_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-bfd_peXXigen_c 25 Oct 2011 14:09:02 -0000 @@ -0,0 +1,22 @@ +$OpenBSD$ +Fix out-of-bounds memcpys (FILNMLEN is 18, sizeof x_fname is 14). +--- bfd/peXXigen.c.orig Tue Oct 25 15:31:49 2011 ++++ bfd/peXXigen.c Tue Oct 25 15:32:39 2011 +@@ -249,7 +249,7 @@ _bfd_XXi_swap_aux_in (bfd * abfd, + in->x_file.x_n.x_offset = H_GET_32 (abfd, ext->x_file.x_n.x_offset); + } + else +- memcpy (in->x_file.x_fname, ext->x_file.x_fname, FILNMLEN); ++ memcpy (in->x_file.x_fname, ext->x_file.x_fname, sizeof in->x_file.x_fname); + return; + + case C_STAT: +@@ -323,7 +323,7 @@ _bfd_XXi_swap_aux_out (bfd * abfd, + H_PUT_32 (abfd, in->x_file.x_n.x_offset, ext->x_file.x_n.x_offset); + } + else +- memcpy (ext->x_file.x_fname, in->x_file.x_fname, FILNMLEN); ++ memcpy (ext->x_file.x_fname, in->x_file.x_fname, sizeof ext->x_file.x_fname); + + return AUXESZ; + Index: peXXigen.c =================================================================== RCS file: /cvs/src/gnu/usr.bin/binutils/bfd/peXXigen.c,v retrieving revision 1.4 diff -u -r1.4 peXXigen.c --- peXXigen.c 2 Nov 2004 20:45:11 -0000 1.4 +++ peXXigen.c 25 Oct 2011 14:16:35 -0000 @@ -271,7 +271,7 @@ in->x_file.x_n.x_offset = H_GET_32 (abfd, ext->x_file.x_n.x_offset); } else - memcpy (in->x_file.x_fname, ext->x_file.x_fname, FILNMLEN); + memcpy (in->x_file.x_fname, ext->x_file.x_fname, sizeof in->x_file.x_fname); return; case C_STAT: @@ -344,7 +344,7 @@ H_PUT_32 (abfd, in->x_file.x_n.x_offset, ext->x_file.x_n.x_offset); } else - memcpy (ext->x_file.x_fname, in->x_file.x_fname, FILNMLEN); + memcpy (ext->x_file.x_fname, in->x_file.x_fname, sizeof ext->x_file.x_fname); return AUXESZ; Index: peXXigen.c =================================================================== RCS file: /cvs/src/gnu/usr.bin/binutils-2.17/bfd/peXXigen.c,v retrieving revision 1.1.1.1 diff -u -r1.1.1.1 peXXigen.c --- peXXigen.c 24 Apr 2011 20:14:42 -0000 1.1.1.1 +++ peXXigen.c 25 Oct 2011 14:17:23 -0000 @@ -235,7 +235,7 @@ in->x_file.x_n.x_offset = H_GET_32 (abfd, ext->x_file.x_n.x_offset); } else - memcpy (in->x_file.x_fname, ext->x_file.x_fname, FILNMLEN); + memcpy (in->x_file.x_fname, ext->x_file.x_fname, sizeof in->x_file.x_fname); return; case C_STAT: @@ -308,7 +308,7 @@ H_PUT_32 (abfd, in->x_file.x_n.x_offset, ext->x_file.x_n.x_offset); } else - memcpy (ext->x_file.x_fname, in->x_file.x_fname, FILNMLEN); + memcpy (ext->x_file.x_fname, in->x_file.x_fname, sizeof ext->x_file.x_fname); return AUXESZ;