Fix memory access problems exposed by fuzzed binaries.

	PR binutils/17512
	* objdump.c (free_debug_section): Reset the compress_status as
	well.

	* compress.c (bfd_get_full_section_contents): Fail if there are no
	section contents available when the compress_status is
	COMPRESS_SECTION_DONE.
	* libbfd.c (bfd_malloc): Refuse to allocate a negative size.
	(bfd_malloc2): Use bfd_malloc.
	(bfd_realloc): Refuse to reallocate a negative size.
	(bfd_realloc2): Use bfd_realloc.
	(bfd_realloc_or_free): Use bfd_realloc.
	(bfd_zmalloc): Use bfd_malloc.
	(bfd_zmalloc): Use bfd_malloc2.
	* opncls.c (bfd_alloc): Refuse to allocate a negative size.

1 files changed, 28 insertions, 99 deletions

diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index 6352c9c..ade8e0f 100644
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -171,15 +171,18 @@ void *
 bfd_malloc (bfd_size_type size)
 {
   void *ptr;
+  size_t sz = (size_t) size;
 
-  if (size != (size_t) size)
+  if (size != sz
+      /* This is to pacify memory checkers like valgrind.  */
+      || ((signed long) sz) < 0)
     {
       bfd_set_error (bfd_error_no_memory);
       return NULL;
     }
 
-  ptr = malloc ((size_t) size);
-  if (ptr == NULL && (size_t) size != 0)
+  ptr = malloc (sz);
+  if (ptr == NULL && sz != 0)
     bfd_set_error (bfd_error_no_memory);
 
   return ptr;
@@ -190,8 +193,6 @@ bfd_malloc (bfd_size_type size)
 void *
 bfd_malloc2 (bfd_size_type nmemb, bfd_size_type size)
 {
-  void *ptr;
-
   if ((nmemb | size) >= HALF_BFD_SIZE_TYPE
       && size != 0
       && nmemb > ~(bfd_size_type) 0 / size)
@@ -200,19 +201,7 @@ bfd_malloc2 (bfd_size_type nmemb, bfd_size_type size)
       return NULL;
     }
 
-  size *= nmemb;
-
-  if (size != (size_t) size)
-    {
-      bfd_set_error (bfd_error_no_memory);
-      return NULL;
-    }
-
-  ptr = malloc ((size_t) size);
-  if (ptr == NULL && (size_t) size != 0)
-    bfd_set_error (bfd_error_no_memory);
-
-  return ptr;
+  return bfd_malloc (size * nmemb);
 }
 
 /* Reallocate memory using realloc.  */
@@ -221,19 +210,22 @@ void *
 bfd_realloc (void *ptr, bfd_size_type size)
 {
   void *ret;
+  size_t sz = (size_t) size;
+
+  if (ptr == NULL)
+    return bfd_malloc (size);
 
-  if (size != (size_t) size)
+  if (size != sz
+      /* This is to pacify memory checkers like valgrind.  */
+      || ((signed long) sz) < 0)
     {
       bfd_set_error (bfd_error_no_memory);
       return NULL;
     }
 
-  if (ptr == NULL)
-    ret = malloc ((size_t) size);
-  else
-    ret = realloc (ptr, (size_t) size);
+  ret = realloc (ptr, sz);
 
-  if (ret == NULL && (size_t) size != 0)
+  if (ret == NULL && sz != 0)
     bfd_set_error (bfd_error_no_memory);
 
   return ret;
@@ -244,8 +236,6 @@ bfd_realloc (void *ptr, bfd_size_type size)
 void *
 bfd_realloc2 (void *ptr, bfd_size_type nmemb, bfd_size_type size)
 {
-  void *ret;
-
   if ((nmemb | size) >= HALF_BFD_SIZE_TYPE
       && size != 0
       && nmemb > ~(bfd_size_type) 0 / size)
@@ -254,23 +244,7 @@ bfd_realloc2 (void *ptr, bfd_size_type nmemb, bfd_size_type size)
       return NULL;
     }
 
-  size *= nmemb;
-
-  if (size != (size_t) size)
-    {
-      bfd_set_error (bfd_error_no_memory);
-      return NULL;
-    }
-
-  if (ptr == NULL)
-    ret = malloc ((size_t) size);
-  else
-    ret = realloc (ptr, (size_t) size);
-
-  if (ret == NULL && (size_t) size != 0)
-    bfd_set_error (bfd_error_no_memory);
-
-  return ret;
+  return bfd_realloc (ptr, size * nmemb);
 }
 
 /* Reallocate memory using realloc.
@@ -279,24 +253,10 @@ bfd_realloc2 (void *ptr, bfd_size_type nmemb, bfd_size_type size)
 void *
 bfd_realloc_or_free (void *ptr, bfd_size_type size)
 {
-  size_t amount = (size_t) size;
-  void *ret;
+  void *ret = bfd_realloc (ptr, size);
 
-  if (size != amount)
-    ret = NULL;
-  else if (ptr == NULL)
-    ret = malloc (amount);
-  else
-    ret = realloc (ptr, amount);
-
-  if (ret == NULL)
-    {
-      if (amount > 0)
-	bfd_set_error (bfd_error_no_memory);
-
-      if (ptr != NULL)
-	free (ptr);
-    }
+  if (ret == NULL && ptr != NULL)
+    free (ptr);
 
   return ret;
 }
@@ -306,23 +266,10 @@ bfd_realloc_or_free (void *ptr, bfd_size_type size)
 void *
 bfd_zmalloc (bfd_size_type size)
 {
-  void *ptr;
+  void *ptr = bfd_malloc (size);
 
-  if (size != (size_t) size)
-    {
-      bfd_set_error (bfd_error_no_memory);
-      return NULL;
-    }
-
-  ptr = malloc ((size_t) size);
-
-  if ((size_t) size != 0)
-    {
-      if (ptr == NULL)
-	bfd_set_error (bfd_error_no_memory);
-      else
-	memset (ptr, 0, (size_t) size);
-    }
+  if (ptr != NULL && size > 0)
+    memset (ptr, 0, (size_t) size);
 
   return ptr;
 }
@@ -333,32 +280,14 @@ bfd_zmalloc (bfd_size_type size)
 void *
 bfd_zmalloc2 (bfd_size_type nmemb, bfd_size_type size)
 {
-  void *ptr;
+  void *ptr = bfd_malloc2 (nmemb, size);
 
-  if ((nmemb | size) >= HALF_BFD_SIZE_TYPE
-      && size != 0
-      && nmemb > ~(bfd_size_type) 0 / size)
+  if (ptr != NULL)
     {
-      bfd_set_error (bfd_error_no_memory);
-      return NULL;
-    }
+      size_t sz = nmemb * size;
 
-  size *= nmemb;
-
-  if (size != (size_t) size)
-    {
-      bfd_set_error (bfd_error_no_memory);
-      return NULL;
-    }
-
-  ptr = malloc ((size_t) size);
-
-  if ((size_t) size != 0)
-    {
-      if (ptr == NULL)
-	bfd_set_error (bfd_error_no_memory);
-      else
-	memset (ptr, 0, (size_t) size);
+      if (sz > 0)
+	memset (ptr, 0, sz);
     }
 
   return ptr;