diff options
| author | Alan Modra <amodra@gmail.com> | 2018-02-01 18:01:00 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2018-02-01 21:38:02 +1030 |
| commit | f2023ce7e8d70b0155cc6206c901e185260918f0 (patch) | |
| tree | 72cb34345b8326f96a89881deb29af3d11e00094 | |
| parent | 35f48e217ab6f909510bf9ca07325ec16122ae88 (diff) | |
| download | binutils-gdb-f2023ce7e8d70b0155cc6206c901e185260918f0.tar.gz | |
PR22769, crash when running 32-bit objdump on corrupted file
PR 22769
* objdump.c (load_specific_debug_section): Check for overflow
when adding one to section size for a string section terminator.
| -rw-r--r-- | binutils/ChangeLog | 6 | ||||
| -rw-r--r-- | binutils/objdump.c | 7 |
2 files changed, 11 insertions, 2 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog index a492487c257..5f472735a5f 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,9 @@ +2018-02-01 Alan Modra <amodra@gmail.com> + + PR 22769 + * objdump.c (load_specific_debug_section): Check for overflow + when adding one to section size for a string section terminator. + 2018-01-30 Nick Clifton <nickc@redhat.com> PR 22734 diff --git a/binutils/objdump.c b/binutils/objdump.c index 6c4d936b266..d8dca90f40c 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, struct dwarf_section *section = &debug_displays [debug].section; bfd *abfd = (bfd *) file; bfd_byte *contents; + bfd_size_type amt; if (section->start != NULL) { @@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, section->num_relocs = 0; section->address = bfd_get_section_vma (abfd, sec); section->size = bfd_get_section_size (sec); - section->start = contents = malloc (section->size + 1); + amt = section->size + 1; + section->start = contents = malloc (amt); section->user_data = sec; - if (section->start == NULL + if (amt == 0 + || section->start == NULL || !bfd_get_full_section_contents (abfd, sec, &contents)) { free_debug_section (debug); |