Fix an illegal memory access when parsing an ELF file containing corrupt symbol versi...

	PR 29699
	* elf.c (_bfd_elf_slurp_version_tables): Fail if the sh_info field
	of the section header is zero.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index c618d817ff9138507437feec60da9cf0c0cb3773..065017754533731ee5200b5767cf2d1199b07154 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2022-10-19  Nick Clifton  <nickc@redhat.com>
+
+       PR 29699
+       * elf.c (_bfd_elf_slurp_version_tables): Fail if the sh_info field
+       of the section header is zero.
+
 2022-09-09  Nick Clifton  <nickc@redhat.com>
 
        PR 29532

diff --git a/bfd/elf.c b/bfd/elf.c
index fe00e0f91899acfa3c43e6780935604183698b2d..7cd7febcf954110e56bccdc8ab6e191a3fdd56c4 100644 (file)
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -8918,7 +8918,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
          bfd_set_error (bfd_error_file_too_big);
          goto error_return_verref;
        }
-      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_alloc (abfd, amt);
+      if (amt == 0)
+       goto error_return_verref;
+      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_zalloc (abfd, amt);
       if (elf_tdata (abfd)->verref == NULL)
        goto error_return_verref;