PR24644, OOM-Bug in _bfd_archive_64_bit_slurp_armap

	PR 24644
	* archive64.c (_bfd_archive_64_bit_slurp_armap): Properly check
	for overflow in expressions involving nsymz.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index ae30d7e94b9b7fc5ed4eecbec26c2a43fd606b78..6958ed70f173f540bf8d2009e464497a56a3c567 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2019-08-07  Alan Modra  <amodra@gmail.com>
+
+       PR 24644
+       * archive64.c (_bfd_archive_64_bit_slurp_armap): Properly check
+       for overflow in expressions involving nsymz.
+
 2019-08-01  Ilia Diachkov  <ilia.diachkov@optimitech.com>
 
        * elfnn-riscv.c (_bfd_riscv_relax_lui): Set lui relax safety area to

diff --git a/bfd/archive64.c b/bfd/archive64.c
index 42f6ed92f095fb5cc404801b9d897bc7669bab41..a2c628e2b55ede4bca6766ec83f68bf9d1e44270 100644 (file)
--- a/bfd/archive64.c
+++ b/bfd/archive64.c
@@ -90,7 +90,14 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)
   ptrsize = 8 * nsymz;
 
   amt = carsym_size + stringsize + 1;
-  if (carsym_size < nsymz || ptrsize < nsymz || amt < nsymz)
+  if (/* Catch overflow in stringsize (and ptrsize) expression.  */
+      nsymz >= (bfd_size_type) -1 / 8
+      || stringsize > parsed_size
+      /* Catch overflow in carsym_size expression.  */
+      || nsymz > (bfd_size_type) -1 / sizeof (carsym)
+      /* Catch overflow in amt expression.  */
+      || amt <= carsym_size
+      || amt <= stringsize)
     {
       bfd_set_error (bfd_error_malformed_archive);
       return FALSE;