Stop objdump from attempting to allocate a huge chunk of memory when parsing relocs in a corrupt file.

	PR 22508
	* objdump.c (dump_relocs_in_section): Also check the section's
	relocation count to make sure that it is reasonable before
	attempting to allocate space for the relocs.

2 files changed, 17 insertions, 1 deletions

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 1a592e56527..bacb7628b86 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,10 @@
+2017-11-29  Nick Clifton  <nickc@redhat.com>
+
+	PR 22508
+	* objdump.c (dump_relocs_in_section): Also check the section's
+	relocation count to make sure that it is reasonable before
+	attempting to allocate space for the relocs.
+
 2017-11-29  Stefan Stroe  <stroestefan@gmail.com>
 
 	* po/Make-in (datadir): Define as @datadir@.
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 40b4acf49fd..e7d91e8d578 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -3427,7 +3427,16 @@ dump_relocs_in_section (bfd *abfd,
     }
 
   if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0
-      && (ufile_ptr) relsize > bfd_get_file_size (abfd))
+      && (((ufile_ptr) relsize > bfd_get_file_size (abfd))
+	  /* Also check the section's reloc count since if this is negative
+	     (or very large) the computation in bfd_get_reloc_upper_bound
+	     may have resulted in returning a small, positive integer.
+	     See PR 22508 for a reproducer.
+
+	     Note - we check against file size rather than section size as
+	     it is possible for there to be more relocs that apply to a
+	     section than there are bytes in that section.  */
+	  || (section->reloc_count > bfd_get_file_size (abfd))))
     {
       printf (" (too many: 0x%x)\n", section->reloc_count);
       bfd_set_error (bfd_error_file_truncated);