From: Nick Clifton <nickc@redhat.com>
Date: Fri, 30 Nov 2018 11:45:33 +0000 (+0000)
Subject: Fix a memory exhaustion bug when attempting to allocate room for an impossible number... 
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=5f60af5d24d181371d67534fa273dd221df20c07;p=binutils-gdb.git

Fix a memory exhaustion bug when attempting to allocate room for an impossible number of program headers.

	* elfcode.h (elf_object_p): Check for corrupt input files with
	more program headers than can actually fit in the file.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 6ea483597df..f99b0854e70 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,8 @@
+2018-11-30  Nick Clifton  <nickc@redhat.com>
+
+	* elfcode.h (elf_object_p): Check for corrupt input files with
+	more program headers than can actually fit in the file.
+
 2018-11-30  Nick Clifton  <nickc@redhat.com>
 
 	PR 23932
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
index f224c8b79d2..16ed8e5bb4d 100644
--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
@@ -784,6 +784,11 @@ elf_object_p (bfd *abfd)
       if (i_ehdrp->e_phnum > ((bfd_size_type) -1) / sizeof (*i_phdr))
 	goto got_wrong_format_error;
 #endif
+      /* Check for a corrupt input file with an impossibly large number
+	 of program headers.  */
+      if (bfd_get_file_size (abfd) > 0
+	  && i_ehdrp->e_phnum > bfd_get_file_size (abfd))
+	goto got_no_match;
       amt = (bfd_size_type) i_ehdrp->e_phnum * sizeof (*i_phdr);
       elf_tdata (abfd)->phdr = (Elf_Internal_Phdr *) bfd_alloc (abfd, amt);
       if (elf_tdata (abfd)->phdr == NULL)