Missing check for NULL

Missing check for NULL

[jacob navia]

[-- Attachment #1: Type: text/plain, Size: 1292 bytes --]

Hi

A missing check for NULL.
FILE: elf.c line 3091
Function: _bfd_elf_init_reloc_shdr
static bool
_bfd_elf_init_reloc_shdr (bfd *abfd,
			  struct bfd_elf_section_reloc_data *reldata,
			  const char *sec_name,
			  bool use_rela_p,
			  bool delay_st_name_p)
{
  Elf_Internal_Shdr *rel_hdr;
  const struct elf_backend_data *bed = get_elf_backend_data (abfd);

  BFD_ASSERT (reldata->hdr == NULL);<<<<<<<<<<<<<<< Next line BUG!
  rel_hdr = bfd_zalloc (abfd, sizeof (*rel_hdr)); // bfd_zalloc can return NULL
  reldata->hdr = rel_hdr;

  if (delay_st_name_p)
    rel_hdr->sh_name = (unsigned int) -1;
  else if (!_bfd_elf_set_reloc_sh_name (abfd, rel_hdr, sec_name,
					use_rela_p))
    return false;
  rel_hdr->sh_type = use_rela_p ? SHT_RELA : SHT_REL; // Possible crash
  rel_hdr->sh_entsize = (use_rela_p
			 ? bed->s->sizeof_rela
			 : bed->s->sizeof_rel);
  rel_hdr->sh_addralign = (bfd_vma) 1 << bed->s->log_file_align;
  rel_hdr->sh_flags = 0;
  rel_hdr->sh_addr = 0;
  rel_hdr->sh_size = 0;
  rel_hdr->sh_offset = 0;

  return true;
}

DESCRIPTION: bfd_zalloc can return NULL. This is not checked, and then the result is used 
HOW TO FIX: Add a check after the allocation:
     If (rel_hdr == NULL) return false;
PRIORITY: low.

Jacob

Re: Missing check for NULL

[Alan Modra]

On Tue, Sep 12, 2023 at 05:24:03PM +0200, jacob navia wrote:
> Hi
> HOW TO FIX: Add a check after the allocation:
>      If (rel_hdr == NULL) return false;

Yes.

	* elf.c (_bfd_elf_init_reloc_shdr): Don't segfault on alloc fail.

diff --git a/bfd/elf.c b/bfd/elf.c
index d7109f14039..fa8881e8ea6 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -3659,6 +3659,8 @@ _bfd_elf_init_reloc_shdr (bfd *abfd,
 
   BFD_ASSERT (reldata->hdr == NULL);
   rel_hdr = bfd_zalloc (abfd, sizeof (*rel_hdr));
+  if (rel_hdr == NULL)
+    return false;
   reldata->hdr = rel_hdr;
 
   if (delay_st_name_p)

-- 
Alan Modra
Australia Development Lab, IBM