[binutils-gdb] Fix illegal memory access when bfd_get_section_contents is called with a NULL section pointer.

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=2db414c36b4f030782c2c8a24c916c3033261af0

commit 2db414c36b4f030782c2c8a24c916c3033261af0
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 5 13:30:27 2024 +0100

    Fix illegal memory access when bfd_get_section_contents is called with a NULL section pointer.
    
      PR 31843

Diff:
---
 bfd/section.c     | 44 ++++++++++++++++++++++++++++++++++----------
 opcodes/nfp-dis.c |  7 +++++++
 2 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/bfd/section.c b/bfd/section.c
index 778a6f75160..81def037e6a 100644
--- a/bfd/section.c
+++ b/bfd/section.c
@@ -1565,24 +1565,36 @@ bfd_get_section_contents (bfd *abfd,
 {
   bfd_size_type sz;
 
-  if (section->flags & SEC_CONSTRUCTOR)
+  if (count == 0)
+    /* Don't bother.  */
+    return true;
+
+  if (section == NULL)
     {
-      memset (location, 0, (size_t) count);
-      return true;
+      bfd_set_error (bfd_error_bad_value);
+      return false;
     }
 
-  sz = bfd_get_section_limit_octets (abfd, section);
-  if ((bfd_size_type) offset > sz
-      || count > sz - offset
-      || count != (size_t) count)
+  if (location == NULL)
     {
+      if (section->mmapped_p)
+	{
+	  /* Pass this request straight on to the target's function.
+	     All of the code below assumes that location != NULL.
+	     FIXME: Should we still check that count is sane ?  */
+	  return BFD_SEND (abfd, _bfd_get_section_contents,
+			   (abfd, section, location, offset, count));
+	}
+
       bfd_set_error (bfd_error_bad_value);
       return false;
     }
 
-  if (count == 0)
-    /* Don't bother.  */
-    return true;
+  if (section->flags & SEC_CONSTRUCTOR)
+    {
+      memset (location, 0, (size_t) count);
+      return true;
+    }
 
   if ((section->flags & SEC_HAS_CONTENTS) == 0)
     {
@@ -1590,6 +1602,18 @@ bfd_get_section_contents (bfd *abfd,
       return true;
     }
 
+  if (abfd == NULL)
+    return false;
+
+  sz = bfd_get_section_limit_octets (abfd, section);
+  if ((bfd_size_type) offset > sz
+      || count > sz - offset
+      || count != (size_t) count)
+    {
+      bfd_set_error (bfd_error_bad_value);
+      return false;
+    }
+
   if ((section->flags & SEC_IN_MEMORY) != 0)
     {
       if (section->contents == NULL)
diff --git a/opcodes/nfp-dis.c b/opcodes/nfp-dis.c
index 093c567100c..ade5fd1d7ad 100644
--- a/opcodes/nfp-dis.c
+++ b/opcodes/nfp-dis.c
@@ -2559,6 +2559,13 @@ init_nfp3200_priv (nfp_priv_data * priv, struct disassemble_info *dinfo)
       return false;
     }
 
+  if (sec->bfd_section == NULL)
+    {
+      /* See PR 31843 for an example of this.  */
+      dinfo->fprintf_func (dinfo->stream, _("The ME-Config section is corrupt."));
+      return false;
+    }
+
   for (roff = 0; (bfd_size_type) roff < sec->sh_size;
        roff += sec->sh_entsize, menum_linear++)
     {