This is the mail archive of the
binutils-cvs@sourceware.org
mailing list for the binutils project.
[binutils-gdb] PR22769, crash when running 32-bit objdump on corrupted file
- From: Alan Modra <amodra at sourceware dot org>
- To: bfd-cvs at sourceware dot org
- Date: 1 Feb 2018 11:10:08 -0000
- Subject: [binutils-gdb] PR22769, crash when running 32-bit objdump on corrupted file
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f2023ce7e8d70b0155cc6206c901e185260918f0
commit f2023ce7e8d70b0155cc6206c901e185260918f0
Author: Alan Modra <amodra@gmail.com>
Date: Thu Feb 1 18:01:00 2018 +1030
PR22769, crash when running 32-bit objdump on corrupted file
PR 22769
* objdump.c (load_specific_debug_section): Check for overflow
when adding one to section size for a string section terminator.
Diff:
---
binutils/ChangeLog | 6 ++++++
binutils/objdump.c | 7 +++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index a492487..5f47273 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2018-02-01 Alan Modra <amodra@gmail.com>
+
+ PR 22769
+ * objdump.c (load_specific_debug_section): Check for overflow
+ when adding one to section size for a string section terminator.
+
2018-01-30 Nick Clifton <nickc@redhat.com>
PR 22734
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 6c4d936..d8dca90 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
struct dwarf_section *section = &debug_displays [debug].section;
bfd *abfd = (bfd *) file;
bfd_byte *contents;
+ bfd_size_type amt;
if (section->start != NULL)
{
@@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
section->num_relocs = 0;
section->address = bfd_get_section_vma (abfd, sec);
section->size = bfd_get_section_size (sec);
- section->start = contents = malloc (section->size + 1);
+ amt = section->size + 1;
+ section->start = contents = malloc (amt);
section->user_data = sec;
- if (section->start == NULL
+ if (amt == 0
+ || section->start == NULL
|| !bfd_get_full_section_contents (abfd, sec, &contents))
{
free_debug_section (debug);