FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

PR26337, Malloc size error in objdump

Browse source 
A malloc failure triggered by a fuzzed object file isn't a real
problem unless objdump doesn't exit cleanly after the failure, which
it does.  However we have bfd_malloc_and_get_section to sanity check
size of uncompressed sections before allocating memory.  Use it.

	PR 26337
	* objdump.c (load_specific_debug_section): Don't malloc space for
	section contents, use bfd_malloc_and_get_section.
This commit is contained in:
Alan Modra 2020-08-05 10:03:00 +09:30
parent b7563b2492
commit 0b97e81846
2 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
binutils/objdump.c
View file

@ -3545,6 +3545,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
if (streq (section->filename, bfd_get_filename (abfd)))
return TRUE;
free (section->start);
section->start = NULL;
}
section->filename = bfd_get_filename (abfd);
@ -3557,22 +3558,20 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
alloced = amt = section->size + 1;
if (alloced != amt || alloced == 0)
{
section->start = NULL;
free_debug_section (debug);
printf (_("\nSection '%s' has an invalid size: %#llx.\n"),
sanitize_string (section->name),
(unsigned long long) section->size);
return FALSE;
}
section->start = contents = malloc (alloced);
if (section->start == NULL
|| !bfd_get_full_section_contents (abfd, sec, &contents))
if (!bfd_malloc_and_get_section (abfd, sec, &contents))
{
free_debug_section (debug);
printf (_("\nCan't get contents for section '%s'.\n"),
sanitize_string (section->name));
return FALSE;
}
section->start = contents;
/* Ensure any string section has a terminating NUL. */
section->start[section->size] = 0;