asan: heap-buffer-overflow objdump.c:3299 in disassemble_bytes

[thirdparty/binutils-gdb.git] / binutils / objdump.c

diff --git a/binutils/objdump.c b/binutils/objdump.c
index 7beb221cb2f1101a32022d24114eca4a3908de4a..8293387558faf91d361c0c0e389ea0221810f6d0 100644 (file)
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -3923,30 +3923,26 @@ disassemble_section (bfd *abfd, asection *section, void *inf)
                   (*rel_pp)->address - rel_offset < sym_offset)
                          ++rel_pp;
 
+                 loop_until = next_sym;
                  if (sym->flags & BSF_FUNCTION)
                    {
-                     if (bfd_get_flavour (abfd) == bfd_target_elf_flavour
-                         && ((elf_symbol_type *) sym)->internal_elf_sym.st_size > 0)
-                       {
-                         /* Sym is a function symbol with a size associated
-                            with it.  Turn on automatic disassembly for the
-                            next VALUE bytes.  */
-                         stop_offset = addr_offset
-                           + ((elf_symbol_type *) sym)->internal_elf_sym.st_size;
-                         loop_until = stop_offset_reached;
-                       }
-                     else
+                     loop_until = function_sym;
+
+                     if (bfd_get_flavour (abfd) == bfd_target_elf_flavour)
                        {
-                         /* Otherwise we need to tell the loop heuristic to
-                            loop until the next function symbol is encountered.  */
-                         loop_until = function_sym;
+                         bfd_size_type fsize =
+                           ((elf_symbol_type *) sym)->internal_elf_sym.st_size;
+                         if (addr_offset + fsize > addr_offset
+                             && addr_offset + fsize <= stop_offset)
+                           {
+                             /* Sym is a function symbol with a valid
+                                size associated with it.  Disassemble
+                                to the end of the function.  */
+                             stop_offset = addr_offset + fsize;
+                             loop_until = stop_offset_reached;
+                           }
                        }
                    }
-                 else
-                   {
-                     /* Otherwise loop until the next symbol is encountered.  */
-                     loop_until = next_sym;
-                   }
                }
 
              free (alloc);