diff options
| author | Nick Clifton <nickc@redhat.com> | 2017-11-29 12:40:43 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2017-11-29 12:40:43 +0000 |
| commit | d785b7d4b877ed465d04072e17ca19d0f47d840f (patch) | |
| tree | b3e9d4dcae256ebfc82447e4a55bf9a609fd229e /binutils/objdump.c | |
| parent | 08f650e6b657e59959d7db8af100720721bd10a2 (diff) | |
| download | binutils-gdb-d785b7d4b877ed465d04072e17ca19d0f47d840f.tar.gz | |
Stop objdump from attempting to allocate a huge chunk of memory when parsing relocs in a corrupt file.
PR 22508
* objdump.c (dump_relocs_in_section): Also check the section's
relocation count to make sure that it is reasonable before
attempting to allocate space for the relocs.
Diffstat (limited to 'binutils/objdump.c')
| -rw-r--r-- | binutils/objdump.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/binutils/objdump.c b/binutils/objdump.c index 40b4acf49fd..e7d91e8d578 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -3427,7 +3427,16 @@ dump_relocs_in_section (bfd *abfd, } if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0 - && (ufile_ptr) relsize > bfd_get_file_size (abfd)) + && (((ufile_ptr) relsize > bfd_get_file_size (abfd)) + /* Also check the section's reloc count since if this is negative + (or very large) the computation in bfd_get_reloc_upper_bound + may have resulted in returning a small, positive integer. + See PR 22508 for a reproducer. + + Note - we check against file size rather than section size as + it is possible for there to be more relocs that apply to a + section than there are bytes in that section. */ + || (section->reloc_count > bfd_get_file_size (abfd)))) { printf (" (too many: 0x%x)\n", section->reloc_count); bfd_set_error (bfd_error_file_truncated); |