From f2023ce7e8d70b0155cc6206c901e185260918f0 Mon Sep 17 00:00:00 2001 From: Alan Modra <amodra@gmail.com> Date: Thu, 1 Feb 2018 18:01:00 +1030 Subject: [PATCH] PR22769, crash when running 32-bit objdump on corrupted file PR 22769 * objdump.c (load_specific_debug_section): Check for overflow when adding one to section size for a string section terminator. --- binutils/ChangeLog | 6 ++++++ binutils/objdump.c | 7 +++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/binutils/objdump.c b/binutils/objdump.c index 6c4d936..d8dca90 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, struct dwarf_section *section = &debug_displays [debug].section; bfd *abfd = (bfd *) file; bfd_byte *contents; + bfd_size_type amt; if (section->start != NULL) { @@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, section->num_relocs = 0; section->address = bfd_get_section_vma (abfd, sec); section->size = bfd_get_section_size (sec); - section->start = contents = malloc (section->size + 1); + amt = section->size + 1; + section->start = contents = malloc (amt); section->user_data = sec; - if (section->start == NULL + if (amt == 0 + || section->start == NULL || !bfd_get_full_section_contents (abfd, sec, &contents)) { free_debug_section (debug); -- 2.9.3