From: Alan Modra <amodra@gmail.com>
Date: Tue, 23 Oct 2018 08:32:06 +0000 (+1030)
Subject: PR23806, NULL pointer dereference in merge_strings
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=45a0eaf77022963d639d6d19871dbab7b79703fc;p=binutils-gdb.git

PR23806, NULL pointer dereference in merge_strings

	PR 23806
	* merge.c (_bfd_add_merge_section): Don't attempt to merge
	sections with ridiculously large alignments.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 1f3fc1c4d42..c5f7ec78745 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-10-23  Alan Modra  <amodra@gmail.com>
+
+	PR 23806
+	* merge.c (_bfd_add_merge_section): Don't attempt to merge
+	sections with ridiculously large alignments.
+
 2018-10-23  Alan Modra  <amodra@gmail.com>
 
 	PR 23805
diff --git a/bfd/merge.c b/bfd/merge.c
index 5e3bba09825..7de0c886df5 100644
--- a/bfd/merge.c
+++ b/bfd/merge.c
@@ -24,6 +24,7 @@
    as used in ELF SHF_MERGE.  */
 
 #include "sysdep.h"
+#include <limits.h>
 #include "bfd.h"
 #include "elf-bfd.h"
 #include "libbfd.h"
@@ -385,12 +386,18 @@ _bfd_add_merge_section (bfd *abfd, void **psinfo, asection *sec,
       return TRUE;
     }
 
-  align = sec->alignment_power;
-  if ((sec->entsize < (unsigned) 1 << align
+#ifndef CHAR_BIT
+#define CHAR_BIT 8
+#endif
+  if (sec->alignment_power >= sizeof (align) * CHAR_BIT)
+    return TRUE;
+
+  align = 1u << sec->alignment_power;
+  if ((sec->entsize < align
        && ((sec->entsize & (sec->entsize - 1))
 	   || !(sec->flags & SEC_STRINGS)))
-      || (sec->entsize > (unsigned) 1 << align
-	  && (sec->entsize & (((unsigned) 1 << align) - 1))))
+      || (sec->entsize > align
+	  && (sec->entsize & (align - 1))))
     {
       /* Sanity check.  If string character size is smaller than
 	 alignment, then we require character size to be a power