[binutils-gdb] Stop objdump from attempting to allocate a huge chunk of memory when parsing relocs in a corrupt fil

[Nick Clifton <nickc at sourceware dot org>]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d785b7d4b877ed465d04072e17ca19d0f47d840f

commit d785b7d4b877ed465d04072e17ca19d0f47d840f
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Nov 29 12:40:43 2017 +0000

    Stop objdump from attempting to allocate a huge chunk of memory when parsing relocs in a corrupt file.
    
    	PR 22508
    	* objdump.c (dump_relocs_in_section): Also check the section's
    	relocation count to make sure that it is reasonable before
    	attempting to allocate space for the relocs.

Diff:
---
 binutils/ChangeLog |  7 +++++++
 binutils/objdump.c | 11 ++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 1a592e5..bacb762 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,10 @@
+2017-11-29  Nick Clifton  <nickc@redhat.com>
+
+	PR 22508
+	* objdump.c (dump_relocs_in_section): Also check the section's
+	relocation count to make sure that it is reasonable before
+	attempting to allocate space for the relocs.
+
 2017-11-29  Stefan Stroe  <stroestefan@gmail.com>
 
 	* po/Make-in (datadir): Define as @datadir@.
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 40b4acf..e7d91e8 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -3427,7 +3427,16 @@ dump_relocs_in_section (bfd *abfd,
     }
 
   if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0
-      && (ufile_ptr) relsize > bfd_get_file_size (abfd))
+      && (((ufile_ptr) relsize > bfd_get_file_size (abfd))
+	  /* Also check the section's reloc count since if this is negative
+	     (or very large) the computation in bfd_get_reloc_upper_bound
+	     may have resulted in returning a small, positive integer.
+	     See PR 22508 for a reproducer.
+
+	     Note - we check against file size rather than section size as
+	     it is possible for there to be more relocs that apply to a
+	     section than there are bytes in that section.  */
+	  || (section->reloc_count > bfd_get_file_size (abfd))))
     {
       printf (" (too many: 0x%x)\n", section->reloc_count);
       bfd_set_error (bfd_error_file_truncated);