A segfault in bfd/format.c

[Bernd Jendrissek]

[Here is a repeat of a bug report that was hidden among other stuff in a
previous mail]

Here is a segfault in i386-mingw32-dlltool from (linux) binutils-2.13.90.0.20
with neither of my 2 patches anywhere near bfd itself.  (The patches don't
affect this configuration.)  100% reproducible for me.

i386-mingw32-binutils are linked against a libbfd configured natively with
--enable-targets=all --enable-64-bit-bfd on a i686-pc-linux-gnu host.

I could probably hack up a patch to stop the segfault, but I'm too clueless
with bfd to know if it'd be right.



/usr/src/mingw/mingw-runtime-2.4: PATH=/usr/cross/i386-mingw32/bin:$PATH make 
CC="/mnt/disk2/src/gcc-mingw32/gcc/xgcc -B/mnt/disk2/src/gcc-mingw32/gcc" 
DLLTOOL=/usr/cross/i386-mingw32/bin/i386-mingw32-dlltool 
AS=/usr/cross/i386-mingw32/bin/i386-mingw32-as
/usr/cross/i386-mingw32/bin/i386-mingw32-dlltool 
--as=/usr/cross/i386-mingw32/bin/i386-mingw32-as -k --dllname crtdll.dll 
--output-lib libcrtdll.a --def crtdll.def
make: *** [libcrtdll.a] Segmentation fault (core dumped)
make: *** Deleting file `libcrtdll.a'
/usr/src/mingw/mingw-runtime-2.4: /mnt/disk2/src/gdb-5.3/gdb/gdb 
/usr/cross/i386-mingw32/bin/i386-mingw32-dlltool core
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...

warning: core file may not match specified executable file.
Core was generated by `/usr/cross/i386-mingw32/bin/i386-mingw32-dlltool 
--as=/usr/cross/i386-mingw32/b'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libbfd-2.13.90.0.20.so...done.
Loaded symbols for /usr/lib/libbfd-2.13.90.0.20.so
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x40086626 in bfd_check_format_matches (abfd=0x8073bf8, format=1077479232, 
matching=0x0) at format.c:309
309                 if (matching_vector[i] == right_targ)
(gdb) down
Bottom (i.e., innermost) frame selected; you cannot go down.
(gdb) list
304           while ((right_targ = *assoc++) != NULL)
305             {
306               int i = match_count;
307
308               while (--i >= 0)
309                 if (matching_vector[i] == right_targ)
310                   break;
311
312               if (i >= 0)
313                 {
(gdb) bt
#0  0x40086626 in bfd_check_format_matches (abfd=0x8073bf8, format=1077479232, 
matching=0x0) at format.c:309
#1  0x400863fe in bfd_check_format (abfd=0x4038f7a4, format=1077475236) at 
format.c:93
#2  0x4007f6e5 in _bfd_write_archive_contents (arch=0x806f6d8) at archive.c:1721
#3  0x40087d2b in bfd_close (abfd=0x806f6d8) at opncls.c:425
#4  0x0804db0c in gen_lib_file () at dlltool.c:2903
#5  0x0804ea6f in main (ac=9, av=0x0) at dlltool.c:3480


Seems like matching_vector ends up being used although matching == 0.