From: Nick Clifton <nickc@redhat.com>
Date: Wed, 1 Nov 2017 15:21:46 +0000 (+0000)
Subject: Prevent illegal memory accesses when attempting to read excessively large COFF line... 
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=a67d66eb97e7613a38ffe6622d837303b3ecd31d;p=binutils-gdb.git

Prevent illegal memory accesses when attempting to read excessively large COFF line number tables.

	PR 22376
	* coffcode.h (coff_slurp_line_table): Check for an excessively
	large line number count.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 60fbc9c8e48..35308ab8343 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2017-11-01  Nick Clifton  <nickc@redhat.com>
+
+	PR 22376
+	* coffcode.h (coff_slurp_line_table): Check for an excessively
+	large line number count.
+
 2017-11-01  Nick Clifton  <nickc@redhat.com>
 
 	PR 22373
diff --git a/bfd/coffcode.h b/bfd/coffcode.h
index 21308de8c31..6da0afa26d2 100644
--- a/bfd/coffcode.h
+++ b/bfd/coffcode.h
@@ -4578,6 +4578,14 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 
   BFD_ASSERT (asect->lineno == NULL);
 
+  if (asect->lineno_count > asect->size)
+    {
+      _bfd_error_handler
+	(_("%B: warning: line number count (%#lx) exceeds section size (%#lx)"),
+	 abfd, (unsigned long) asect->lineno_count, (unsigned long) asect->size);
+      return FALSE;
+    }
+
   amt = ((bfd_size_type) asect->lineno_count + 1) * sizeof (alent);
   lineno_cache = (alent *) bfd_alloc (abfd, amt);
   if (lineno_cache == NULL)