diff options
| author | Nick Clifton <nickc@redhat.com> | 2017-05-02 11:54:53 +0100 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2017-05-02 11:54:53 +0100 |
| commit | 39ff1b79f687b65f4144ddb379f22587003443fb (patch) | |
| tree | 0b1c093f6bd2cc8f4a1f85b9327b37a0feb6a15d /binutils/objdump.c | |
| parent | d050f7d7f474c7e3ba26902a9cbb185910921a11 (diff) | |
| download | binutils-39ff1b79f687b65f4144ddb379f22587003443fb.zip binutils-39ff1b79f687b65f4144ddb379f22587003443fb.tar.gz binutils-39ff1b79f687b65f4144ddb379f22587003443fb.tar.bz2 | |
Prevent memory exhaustion from a corrupt PE binary with an overlarge number of relocs.
PR 21440
* objdump.c (dump_relocs_in_section): Check for an excessive
number of relocs before attempting to dump them.
Diffstat (limited to 'binutils/objdump.c')
| -rw-r--r-- | binutils/objdump.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/binutils/objdump.c b/binutils/objdump.c index bc61000..5972da1 100644 --- a/binutils/objdump.c +++ b/binutils/objdump.c @@ -3379,6 +3379,14 @@ dump_relocs_in_section (bfd *abfd, return; } + if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0 + && relsize > get_file_size (bfd_get_filename (abfd))) + { + printf (" (too many: 0x%x)\n", section->reloc_count); + bfd_set_error (bfd_error_file_truncated); + bfd_fatal (bfd_get_filename (abfd)); + } + relpp = (arelent **) xmalloc (relsize); relcount = bfd_canonicalize_reloc (abfd, section, relpp, syms); |