Re: Yet another ecoff fuzzed object fix

In commit 6fc018e9e593 I replaced the fdr_ptr csym check against the
header isymMax count with a check against bfd symcount.  In fact, both
checks are needed.  The isymMax check sanity checks accesses against
the external sym array, the symcount one against the internal array.

	* ecoff.c (_bfd_ecoff_slurp_symbol_table): Reinstate fdr_ptr
	csym check against isymMax.

diff --git a/bfd/ecoff.c b/bfd/ecoff.c
index 533ff1900c0ef1460bbe41fb20f7eb5391bbe3f7..04501761bd6e1a171db713f041c74fbf5f2ba7dc 100644 (file)
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -966,6 +966,7 @@ _bfd_ecoff_slurp_symbol_table (bfd *abfd)
       if (fdr_ptr->isymBase < 0
          || fdr_ptr->isymBase > symhdr->isymMax
          || fdr_ptr->csym < 0
+         || fdr_ptr->csym > symhdr->isymMax - fdr_ptr->isymBase
          || fdr_ptr->csym > ((long) bfd_get_symcount (abfd)
                              - (internal_ptr - internal))
          || fdr_ptr->issBase < 0