From f2023ce7e8d70b0155cc6206c901e185260918f0 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 1 Feb 2018 18:01:00 +1030 Subject: [PATCH] PR22769, crash when running 32-bit objdump on corrupted file PR 22769 * objdump.c (load_specific_debug_section): Check for overflow when adding one to section size for a string section terminator. --- binutils/ChangeLog | 6 ++++++ binutils/objdump.c | 7 +++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/binutils/ChangeLog b/binutils/ChangeLog index a492487c257..5f472735a5f 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2018-02-01 Alan Modra + + PR 22769 + * objdump.c (load_specific_debug_section): Check for overflow + when adding one to section size for a string section terminator. + 2018-01-30 Nick Clifton PR 22734 diff --git a/binutils/objdump.c b/binutils/objdump.c index 6c4d936b266..d8dca90f40c 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, struct dwarf_section *section = &debug_displays [debug].section; bfd *abfd = (bfd *) file; bfd_byte *contents; + bfd_size_type amt; if (section->start != NULL) { @@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, section->num_relocs = 0; section->address = bfd_get_section_vma (abfd, sec); section->size = bfd_get_section_size (sec); - section->start = contents = malloc (section->size + 1); + amt = section->size + 1; + section->start = contents = malloc (amt); section->user_data = sec; - if (section->start == NULL + if (amt == 0 + || section->start == NULL || !bfd_get_full_section_contents (abfd, sec, &contents)) { free_debug_section (debug); -- 2.30.2