cmd/link: check magic header

Change-Id: I84b0e1d86728a76bc6a87fee4accf6fc43d87006
Reviewed-on: https://go-review.googlesource.com/54814Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

src/cmd/link/internal/ld/ar.go

@@ -82,6 +82,10 @@ func hostArchive(ctxt *Link, name string) {
 		Exitf("file %s too short", name)
 	}
 
+	if string(magbuf[:]) != ARMAG {
+		Exitf("%s is not an archive file", name)
+	}
+
 	var arhdr ArHdr
 	l := nextar(f, f.Offset(), &arhdr)
 	if l <= 0 {

src/cmd/link/internal/ld/lib.go

@@ -724,8 +724,17 @@ func genhash(ctxt *Link, lib *Library) {
 	}
 	defer f.Close()
 
+	var magbuf [len(ARMAG)]byte
+	if _, err := io.ReadFull(f, magbuf[:]); err != nil {
+		Exitf("file %s too short", lib.File)
+	}
+
+	if string(magbuf[:]) != ARMAG {
+		Exitf("%s is not an archive file", lib.File)
+	}
+
 	var arhdr ArHdr
-	l := nextar(f, int64(len(ARMAG)), &arhdr)
+	l := nextar(f, f.Offset(), &arhdr)
 	if l <= 0 {
 		Errorf(nil, "%s: short read on archive file symbol header", lib.File)
 		return