FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

PR22769, crash when running 32-bit objdump on corrupted file

Browse source 
PR 22769
	* objdump.c (load_specific_debug_section): Check for overflow
	when adding one to section size for a string section terminator.
This commit is contained in:
Alan Modra 2018-02-01 18:01:00 +10:30
parent 35f48e217a
commit f2023ce7e8
2 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
binutils/objdump.c
View file

@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
struct dwarf_section *section = &debug_displays [debug].section;
bfd *abfd = (bfd *) file;
bfd_byte *contents;
bfd_size_type amt;
if (section->start != NULL)
{
@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
section->num_relocs = 0;
section->address = bfd_get_section_vma (abfd, sec);
section->size = bfd_get_section_size (sec);
section->start = contents = malloc (section->size + 1);
amt = section->size + 1;
section->start = contents = malloc (amt);
section->user_data = sec;
if (section->start == NULL
if (amt == 0
|| section->start == NULL
|| !bfd_get_full_section_contents (abfd, sec, &contents))
{
free_debug_section (debug);