From 88ce53f0570261978845b9defa39f53631b06af1 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 1 Feb 2018 18:01:00 +1030 Subject: [PATCH] PR22769, crash when running 32-bit objdump on corrupted file PR 22769 * objdump.c (load_specific_debug_section): Check for overflow when adding one to section size for a string section terminator. Gbp-Pq: Name pr22769.diff --- binutils/objdump.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/binutils/objdump.c b/binutils/objdump.c index 6c4d936b2..d8dca90f4 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, struct dwarf_section *section = &debug_displays [debug].section; bfd *abfd = (bfd *) file; bfd_byte *contents; + bfd_size_type amt; if (section->start != NULL) { @@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, section->num_relocs = 0; section->address = bfd_get_section_vma (abfd, sec); section->size = bfd_get_section_size (sec); - section->start = contents = malloc (section->size + 1); + amt = section->size + 1; + section->start = contents = malloc (amt); section->user_data = sec; - if (section->start == NULL + if (amt == 0 + || section->start == NULL || !bfd_get_full_section_contents (abfd, sec, &contents)) { free_debug_section (debug); -- 2.30.2