[binutils-gdb] readelf: segfault at readelf.c:12227

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a5e0be5cb29bcbcfee6f1ead2daed9889a2a6ac6

commit a5e0be5cb29bcbcfee6f1ead2daed9889a2a6ac6
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Apr 20 11:01:47 2020 +0930

    readelf: segfault at readelf.c:12227
    
    This is another one where not cleaning up sufficiently after
    processing one file can lead to errors when processing the next file.
    We have ngnuchains non-zero but gnuchains NULL in the following:
      off < ngnuchains && (gnuchains[off] & 1) == 0
    
            * readelf.c (process_symbol_table): Clear ngnuchains, ngnubuckets
            and nbuckets.

Diff:
---
 binutils/ChangeLog | 5 +++++
 binutils/readelf.c | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 86eb5781400..6280eb7c37a 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2020-04-20  Alan Modra  <amodra@gmail.com>
+
+	* readelf.c (process_symbol_table): Clear ngnuchains, ngnubuckets
+	and nbuckets.
+
 2020-04-20  Alan Modra  <amodra@gmail.com>
 
 	* readelf.c (process_section_headers): Free dynamic symbols etc.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index d9c9b7ea0c1..ea30f883c59 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -12188,6 +12188,7 @@ process_symbol_table (Filedata * filedata)
 
   free (buckets);
   buckets = NULL;
+  nbuckets = 0;
   free (chains);
   chains = NULL;
 
@@ -12263,8 +12264,10 @@ process_symbol_table (Filedata * filedata)
     }
   free (gnubuckets);
   gnubuckets = NULL;
+  ngnubuckets = 0;
   free (gnuchains);
   gnuchains = NULL;
+  ngnuchains = 0;
   free (mipsxlat);
   mipsxlat = NULL;
   return TRUE;
@@ -12272,12 +12275,15 @@ process_symbol_table (Filedata * filedata)
  err_out:
   free (gnubuckets);
   gnubuckets = NULL;
+  ngnubuckets = 0;
   free (gnuchains);
   gnuchains = NULL;
+  ngnuchains = 0
   free (mipsxlat);
   mipsxlat = NULL;
   free (buckets);
   buckets = NULL;
+  nbuckets = 0;
   free (chains);
   chains = NULL;
   return FALSE;