Fix more memory faults uncovered by fuzzing various executables.

	PR binutils/17512
	* dwarf.c (read_and_display_attr_value): Check that we do not read
	past end.
	(display_debug_pubnames_worker): Add range checks.
	(process_debug_info): Check for invalid pointer sizes.
	(display_loc_list): Likewise.
	(display_loc_list_dwo): Likewise.
	(display_debug_ranges): Likewise.
	(display_debug_aranges): Check for invalid address size.
	(read_cie): Add range checks.  Replace call strchr with while loop.
	* objdump.c (dump_dwarf): Replace abort with a warning message.
	(print_section_stabs): Improve range checks.
	* rdcoff.c (coff_get_slot): Use long for indx parameter type.
	Add check for an excesively large index.
	* rddbg.c (read_section_stabs_debugging_info): Zero terminate the
	string table.  Avoid walking off the end of the stabs data.
	* stabs.c (parse_stab_string): Add check for a NULL name.

	PR binutils/17512
	* coffcode.h (coff_slurp_line_table): Set the line number of
	corrupt entries to -1.
	(coff_slurp_symbol_table): Alway initialise the value of the
	symbol.
	* coffgen.c (coff_print_symbol): Check that the combined pointer
	is valid.
	(coff_print_symbol): Do not print negative line numbers.
	* peXXigen.c (pe_print_idata): Add range checking displaying
	member names.

1 files changed, 11 insertions, 3 deletions

diff --git a/bfd/coffcode.h b/bfd/coffcode.h
index acc7360..1eb2412 100644
--- a/bfd/coffcode.h
+++ b/bfd/coffcode.h
@@ -4510,7 +4510,7 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
   unsigned int counter;
   alent *cache_ptr;
   bfd_vma prev_offset = 0;
-  int ordered = 1;
+  bfd_boolean ordered = TRUE;
   unsigned int nbr_func;
   LINENO *src;
   bfd_boolean have_func;
@@ -4561,6 +4561,7 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 	      (*_bfd_error_handler)
 		(_("%B: warning: illegal symbol index 0x%lx in line number entry %d"),
 		 abfd, (long) symndx, counter);
+	      cache_ptr->line_number = -1;
 	      continue;
 	    }
 
@@ -4572,11 +4573,12 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 
 	  /* PR 17512 file: 078-10659-0.004  */
 	  if (sym < obj_symbols (abfd)
-	      || sym >= obj_symbols (abfd) + obj_raw_syment_count (abfd))
+	      || sym >= obj_symbols (abfd) + bfd_get_symcount (abfd))
 	    {
 	      (*_bfd_error_handler)
 		(_("%B: warning: illegal symbol in line number entry %d"),
 		 abfd, counter);
+	      cache_ptr->line_number = -1;
 	      continue;
 	    }
 
@@ -4590,7 +4592,7 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 
 	  sym->lineno = cache_ptr;
 	  if (sym->symbol.value < prev_offset)
-	    ordered = 0;
+	    ordered = FALSE;
 	  prev_offset = sym->symbol.value;
 	}
       else if (!have_func)
@@ -4625,6 +4627,8 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 	    if (lineno_cache[i].line_number == 0)
 	      *p++ = &lineno_cache[i];
 
+	  BFD_ASSERT ((p - func_table) == nbr_func);
+	  
 	  /* Sort by functions.  */
 	  qsort (func_table, nbr_func, sizeof (alent *), coff_sort_func_alent);
 
@@ -4650,6 +4654,8 @@ coff_slurp_line_table (bfd *abfd, asection *asect)
 		    *n_cache_ptr++ = *old_ptr++;
 		  while (old_ptr->line_number != 0);
 		}
+	      BFD_ASSERT ((bfd_size_type) (n_cache_ptr - n_lineno_cache) == (amt / sizeof (alent)));
+
 	      memcpy (lineno_cache, n_lineno_cache, amt);
 	    }
 	  bfd_release (abfd, func_table);
@@ -4710,6 +4716,8 @@ coff_slurp_symbol_table (bfd * abfd)
 	  dst->symbol.section = coff_section_from_bfd_index (abfd,
 						     src->u.syment.n_scnum);
 	  dst->symbol.flags = 0;
+	  /* PR 17512: file: 079-7098-0.001:0.1.  */
+	  dst->symbol.value = 0;
 	  dst->done_lineno = FALSE;
 
 	  switch (src->u.syment.n_sclass)