提交: f2023ce7e8d70b0155cc6206c901e185260918f0 - binutils_os216 (git)

GNU Binutils with patches for OS216

Commit MetaInfo

• 修訂: f2023ce7e8d70b0155cc6206c901e185260918f0 (tree)
• 時間: 2018-02-01 20:08:02
• 作者: Alan Modra <amodra@gmai...>
• Commiter: Alan Modra

Log Message

PR22769, crash when running 32-bit objdump on corrupted file

PR 22769
* objdump.c (load_specific_debug_section): Check for overflow
when adding one to section size for a string section terminator.

Change Summary

• modified: binutils/ChangeLog
• modified: binutils/objdump.c

差異

--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
[phone]  Alan Modra  <[e-mail]>
+
+	PR 22769
+	* objdump.c (load_specific_debug_section): Check for overflow
+	when adding one to section size for a string section terminator.
+
 2018-01-30  Nick Clifton  <[e-mail]>
 
 	PR 22734

--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -2466,6 +2466,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
   struct dwarf_section *section = &debug_displays [debug].section;
   bfd *abfd = (bfd *) file;
   bfd_byte *contents;
+  bfd_size_type amt;
 
   if (section->start != NULL)
     {
@@ -2480,9 +2481,11 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
   section->num_relocs = 0;
   section->address = bfd_get_section_vma (abfd, sec);
   section->size = bfd_get_section_size (sec);
-  section->start = contents = malloc (section->size + 1);
+  amt = section->size + 1;
+  section->start = contents = malloc (amt);
   section->user_data = sec;
-  if (section->start == NULL
+  if (amt == 0
+      || section->start == NULL
       || !bfd_get_full_section_contents (abfd, sec, &contents))
     {
       free_debug_section (debug);