[binutils-gdb] Prevent an illegal memory access by objdump when parsing a corrupt file on a 32-bit host.

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=634557801d909982b47b1723f4216ebe8bc784aa

commit 634557801d909982b47b1723f4216ebe8bc784aa
Author: Nick Clifton <nickc@redhat.com>
Date:   Tue Mar 19 13:39:30 2019 +0000

    Prevent an illegal memory access by objdump when parsing a corrupt file on a 32-bit host.
    
    	PR 24360
    	* objdump.c (load_specific_debug_section): Check that the amount
    	of memory to be allocated matches the size of the section.

Diff:
---
 binutils/ChangeLog |  6 ++++++
 binutils/objdump.c | 16 +++++++++-------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 95ea555..6fa4bf4 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2019-03-19  Nick Clifton  <nickc@redhat.com>
+
+	PR 24360
+	* objdump.c (load_specific_debug_section): Check that the amount
+	of memory to be allocated matches the size of the section.
+
 2019-03-13  Sudakshina Das  <sudi.das@arm.com>
 
 	* readelf.c (get_aarch64_dynamic_type): Add case for
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 3ef2716..79aed75 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -382,10 +382,10 @@ nonfatal (const char *msg)
 static const char *
 sanitize_string (const char * in)
 {
-  static char *        buffer = NULL;
-  static unsigned int  buffer_len = 0;
-  const char *         original = in;
-  char *               out;
+  static char *  buffer = NULL;
+  static size_t  buffer_len = 0;
+  const char *   original = in;
+  char *         out;
 
   /* Paranoia.  */
   if (in == NULL)
@@ -2679,6 +2679,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
   bfd *abfd = (bfd *) file;
   bfd_byte *contents;
   bfd_size_type amt;
+  size_t alloced;
 
   if (section->start != NULL)
     {
@@ -2694,8 +2695,9 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
   section->address = bfd_get_section_vma (abfd, sec);
   section->user_data = sec;
   section->size = bfd_get_section_size (sec);
-  amt = section->size + 1;
-  if (amt == 0)
+  /* PR 24360: On 32-bit hosts sizeof (size_t) < sizeof (bfd_size_type). */
+  alloced = amt = section->size + 1;
+  if (alloced != amt || alloced == 0)
     {
       section->start = NULL;
       free_debug_section (debug);
@@ -2704,7 +2706,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
 	      (unsigned long long) section->size);
       return FALSE;
     }
-  section->start = contents = malloc (amt);
+  section->start = contents = malloc (alloced);
   if (section->start == NULL
       || !bfd_get_full_section_contents (abfd, sec, &contents))
     {