Hi

A missing check for NULL.
FILE: elf.c line 3091
Function: _bfd_elf_init_reloc_shdr
static bool
_bfd_elf_init_reloc_shdr (bfd *abfd,
			  struct bfd_elf_section_reloc_data *reldata,
			  const char *sec_name,
			  bool use_rela_p,
			  bool delay_st_name_p)
{
  Elf_Internal_Shdr *rel_hdr;
  const struct elf_backend_data *bed = get_elf_backend_data (abfd);

  BFD_ASSERT (reldata->hdr == NULL);<<<<<<<<<<<<<<< Next line BUG!
  rel_hdr = bfd_zalloc (abfd, sizeof (*rel_hdr)); // bfd_zalloc can return NULL
  reldata->hdr = rel_hdr;

  if (delay_st_name_p)
    rel_hdr->sh_name = (unsigned int) -1;
  else if (!_bfd_elf_set_reloc_sh_name (abfd, rel_hdr, sec_name,
					use_rela_p))
    return false;
  rel_hdr->sh_type = use_rela_p ? SHT_RELA : SHT_REL; // Possible crash
  rel_hdr->sh_entsize = (use_rela_p
			 ? bed->s->sizeof_rela
			 : bed->s->sizeof_rel);
  rel_hdr->sh_addralign = (bfd_vma) 1 << bed->s->log_file_align;
  rel_hdr->sh_flags = 0;
  rel_hdr->sh_addr = 0;
  rel_hdr->sh_size = 0;
  rel_hdr->sh_offset = 0;

  return true;
}

DESCRIPTION: bfd_zalloc can return NULL. This is not checked, and then the result is used 
HOW TO FIX: Add a check after the allocation:
     If (rel_hdr == NULL) return false;
PRIORITY: low.

Jacob