More fixes for memory access errors triggered by attemps to examine corrupted binaries.

	PR binutils/17512
	* dwarf.c (display_block): Do nothing if the block starts after
	the end of the buffer.
	(read_and_display_attr_value): Add range checks.
	(struct Frame_Chunk): Make the ncols and ra fields unsigned.
	(frame_need_space): Test for an ncols of zero.
	(read_cie): Fail if the augmentation data extends off the end of
	the buffer.
	(display_debug_frames): Add checks for read_cie failing.  Add
	range checks.
	* coff-h8300.c (rtype2howto): Replace abort with returning a NULL
	value.
	* coff-h8500.c (rtype2howto): Likewise.
	* coff-tic30.c (rtype2howto): Likewise.
	* coff-z80.c (rtype2howto): Likewise.
	* coff-z8k.c (rtype2howto): Likewise.
	* coff-ia64.c (RTYPE2HOWTO): Always return a valid howto.
	* coff-m68k.c (m68k_rtype2howto): Return a NULL howto if none
	could be found.
	* coff-mcore.c (RTYPE2HOWTO): Add range checking.
	* coff-w65.c (rtype2howto): Likewise.
	* coff-we32k.c (RTYPE2HOWTO): Likewise.
	* pe-mips.c (RTYPE2HOWTO): Likewise.
	* coff-x86_64.c (coff_amd64_reloc): Likewise.  Replace abort with
	an error return.
	* coffcode.h (coff_slurp_reloc_table): Allow the rel parameter to
	be unused.
	* coffgen.c (make_a_section_from_file): Check the length of a
	section name before testing to see if it is a debug section name.
	(coff_object_p): Zero out any uninitialised bytes in the opt
	header.
	* ecoff.c (_bfd_ecoff_slurp_symbolic_info): Test for the raw
	source being empty when there are values to be processed.
	(_bfd_ecoff_slurp_symbol_table): Add range check.
	* mach-o.c (bfd_mach_o_canonicalize_one_reloc): Likewise.
	(bfd_mach_o_mangle_sections): Move test for too many sections to
	before the allocation of the section table.
	(bfd_mach_o_read_symtab_strtab): If the read fails, free the
	memory and nullify the symbol pointer.
	* reloc.c (bfd_generic_get_relocated_section_contents): Add
	handling of a bfd_reloc_notsupported return value.
	* versados.c (EDATA): Add range checking.
	(get_record): Likewise.
	(process_otr): Check for contents being available before updating
	them.
	(versados_canonicalize_reloc): Add range check.

1 files changed, 19 insertions, 7 deletions

diff --git a/bfd/mach-o.c b/bfd/mach-o.c
index c13fff3..31ffa84 100644
--- a/bfd/mach-o.c
+++ b/bfd/mach-o.c
@@ -1349,8 +1349,12 @@ bfd_mach_o_canonicalize_one_reloc (bfd *abfd,
 
       if (reloc.r_extern)
 	{
-	  /* An external symbol number.  */
-	  sym = syms + num;
+	  /* PR 17512: file: 8396-1185-0.004.  */
+	  if (num >= bfd_get_symcount (abfd))
+	    sym = bfd_und_section_ptr->symbol_ptr_ptr;
+	  else
+	    /* An external symbol number.  */
+	    sym = syms + num;
 	}
       else if (num == 0x00ffffff || num == 0)
 	{
@@ -2336,17 +2340,20 @@ bfd_mach_o_mangle_sections (bfd *abfd, bfd_mach_o_data_struct *mdata)
       && (mdata->nsects == 0 || mdata->sections != NULL))
     return TRUE;
 
+  /* We need to check that this can be done...  */
+  if (nsect > 255)
+    {
+      (*_bfd_error_handler) (_("mach-o: there are too many sections (%u)"
+			       " maximum is 255,\n"), nsect);
+      return FALSE;
+    }
+
   mdata->nsects = nsect;
   mdata->sections = bfd_alloc (abfd,
 			       mdata->nsects * sizeof (bfd_mach_o_section *));
   if (mdata->sections == NULL)
     return FALSE;
 
-  /* We need to check that this can be done...  */
-  if (nsect > 255)
-    (*_bfd_error_handler) (_("mach-o: there are too many sections (%d)"
-			     " maximum is 255,\n"), nsect);
-
   /* Create Mach-O sections.
      Section type, attribute and align should have been set when the
      section was created - either read in or specified.  */
@@ -3646,6 +3653,9 @@ bfd_mach_o_read_symtab_strtab (bfd *abfd)
       if (bfd_seek (abfd, sym->stroff, SEEK_SET) != 0
           || bfd_bread (sym->strtab, sym->strsize, abfd) != sym->strsize)
         {
+	  /* PR 17512: file: 10888-1609-0.004.  */
+	  bfd_release (abfd, sym->strtab);
+	  sym->strtab = NULL;
           bfd_set_error (bfd_error_file_truncated);
           return FALSE;
         }
@@ -3675,6 +3685,7 @@ bfd_mach_o_read_symtab_symbols (bfd *abfd)
 
   if (!bfd_mach_o_read_symtab_strtab (abfd))
     {
+      bfd_release (abfd, sym->symbols);
       sym->symbols = NULL;
       return FALSE;
     }
@@ -3683,6 +3694,7 @@ bfd_mach_o_read_symtab_symbols (bfd *abfd)
     {
       if (!bfd_mach_o_read_symtab_symbol (abfd, sym, &sym->symbols[i], i))
 	{
+	  bfd_release (abfd, sym->symbols);
 	  sym->symbols = NULL;
 	  return FALSE;
 	}