Stop objdump from attempting to allocate a huge chunk of memory when parsing relocs...

	PR 22508
	* objdump.c (dump_relocs_in_section): Also check the section's
	relocation count to make sure that it is reasonable before
	attempting to allocate space for the relocs.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 1a592e5..bacb762 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,10 @@
+2017-11-29  Nick Clifton  <nickc@redhat.com>
+
+       PR 22508
+       * objdump.c (dump_relocs_in_section): Also check the section's
+       relocation count to make sure that it is reasonable before
+       attempting to allocate space for the relocs.
+
 2017-11-29  Stefan Stroe  <stroestefan@gmail.com>
 
        * po/Make-in (datadir): Define as @datadir@.

diff --git a/binutils/objdump.c b/binutils/objdump.c
index 40b4acf..e7d91e8 100644 (file)
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -3427,7 +3427,16 @@ dump_relocs_in_section (bfd *abfd,
     }
 
   if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0
-      && (ufile_ptr) relsize > bfd_get_file_size (abfd))
+      && (((ufile_ptr) relsize > bfd_get_file_size (abfd))
+         /* Also check the section's reloc count since if this is negative
+            (or very large) the computation in bfd_get_reloc_upper_bound
+            may have resulted in returning a small, positive integer.
+            See PR 22508 for a reproducer.
+
+            Note - we check against file size rather than section size as
+            it is possible for there to be more relocs that apply to a
+            section than there are bytes in that section.  */
+         || (section->reloc_count > bfd_get_file_size (abfd))))
     {
       printf (" (too many: 0x%x)\n", section->reloc_count);
       bfd_set_error (bfd_error_file_truncated);