another 4.2BSD ld dereferencing 0 bug

Steven M. Kramer smk at axiom.UUCP
Sun Feb 12 08:07:18 AEST 1984


	Well, another bug uncovered in the loader.  Both .stabn and .stabd
(for -g flag) don't have strings and use 0 for the string.  SOME checks are
done for the 0 string, but the order of 2 tests are wrong and should be
reversed.  Before, if a .stabd comes along, the 'L' label check looks at
n_name[0], which is 0[0] -- a no-no on many ports.  Reversing the sense
of the label check and the stab check takes care of the error.  The errors
are on lines 802 and 1183 of the 4.2BSD distribution.
	--steve kramer


	while (text.size > 0) {
		mget((char *)&cursym, sizeof(struct nlist), &text);
		if (cursym.n_un.n_strx) {
			if (cursym.n_un.n_strx<sizeof(size) ||
			    cursym.n_un.n_strx>=size)
				error(1, "bad string table index (pass 1)");
			cursym.n_un.n_name = curstr + cursym.n_un.n_strx;
		}
		type = cursym.n_type;
		if ((type&N_EXT)==0) {
OLD-->			if (Xflag==0 || cursym.n_un.n_name[0]!='L' ||
OLD-->			    type & N_STAB)
NEW-->			if (Xflag==0 || type&N_STAB||cursym.n_un.n_name[0]!='L')
				nlocal += sizeof cursym;
			continue;
		}
		symreloc();
		if (enter(lookup()))
			continue;
		if ((sp = lastsym)->n_type != N_EXT+N_UNDF)
			continue;
		if (cursym.n_type == N_EXT+N_UNDF) {
			if (cursym.n_value > sp->n_value)
				sp->n_value = cursym.n_value;
			continue;
		}
		if (sp->n_value != 0 && cursym.n_type == N_EXT+N_TEXT)
			continue;
		ndef++;
--------------------
--------------------
					tracesym();
					break;
				}
		if ((type&N_EXT) == 0) {
			if (!sflag&&!xflag&&
OLD->			    (!Xflag||cursym.n_un.n_name[0]!='L'||type&N_STAB))
NEW->			    (!Xflag||type&N_STAB||cursym.n_un.n_name[0]!='L'))
				symwrite(&cursym, sout);
			continue;
		}
		if (funding)
-- 
	--steve kramer
	{allegra,genrad,ihnp4,utzoo,philabs,uw-beaver}!linus!axiom!smk	(UUCP)
	linus!axiom!smk at mitre-bedford					(MIL)



More information about the Comp.bugs.4bsd.ucb-fixes mailing list