From 4f1881b94473f1034f950feb863b464435a8fb5f Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Sun, 1 Oct 2017 12:07:07 +1030 Subject: [PATCH] PR22230, buffer overflow in display_debug_macro PR 22230 * objdump.c (load_specific_debug_section): Allocate an extra byte for a terminating NUL. --- binutils/ChangeLog | 6 ++++++ binutils/objdump.c | 9 +++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/binutils/ChangeLog b/binutils/ChangeLog index d9f08991f90..d45eeaf9b5a 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2017-10-01 Alan Modra + + PR 22230 + * objdump.c (load_specific_debug_section): Allocate an extra byte + for a terminating NUL. + 2017-09-30 Alan Modra PR 21978 diff --git a/binutils/objdump.c b/binutils/objdump.c index 3b2c7a38788..83b8b2a273b 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -2475,17 +2475,18 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, section->num_relocs = 0; section->address = bfd_get_section_vma (abfd, sec); section->size = bfd_get_section_size (sec); - section->start = NULL; + section->start = malloc (section->size + 1); section->user_data = sec; - ret = bfd_get_full_section_contents (abfd, sec, §ion->start); - - if (! ret) + if (section->start == NULL + || !bfd_get_full_section_contents (abfd, sec, §ion->start)) { free_debug_section (debug); printf (_("\nCan't get contents for section '%s'.\n"), section->name); return 0; } + /* Ensure any string section has a terminating NUL. */ + section->start[section->size] = 0; if (is_relocatable && debug_displays [debug].relocate) { -- 2.30.2