PR32703, Null pointer dereference in bfd/linker.c

NULL is a possible return from bfd_section_already_linked_table_lookup
if out-of-memory.

	PR 32703
	* linker.c (_bfd_generic_section_already_linked): Catch
	bfd_section_already_linked_table_lookup failure.
	* coffgen.c (_bfd_coff_section_already_linked): Likewise.

diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index 5dbd6666b2b781f1bd1c2c1e8bf97d43da6836ac..f87e54f97229cc823db79677ab9647dd940509f9 100644 (file)
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -2767,6 +2767,8 @@ _bfd_coff_section_already_linked (bfd *abfd,
     }
 
   already_linked_list = bfd_section_already_linked_table_lookup (key);
+  if (!already_linked_list)
+    goto bad;
 
   for (l = already_linked_list->entry; l != NULL; l = l->next)
     {
@@ -2794,7 +2796,10 @@ _bfd_coff_section_already_linked (bfd *abfd,
 
   /* This is the first section with this name.  Record it.  */
   if (!bfd_section_already_linked_table_insert (already_linked_list, sec))
-    info->callbacks->fatal (_("%P: already_linked_table: %E\n"));
+    {
+    bad:
+      info->callbacks->fatal (_("%P: already_linked_table: %E\n"));
+    }
   return false;
 }
 

diff --git a/bfd/linker.c b/bfd/linker.c
index 3466391e19d5f38d9907ade3c47d57003a365fec..2a4b8f02fe6260ae0ba1b7b93af397765e695814 100644 (file)
--- a/bfd/linker.c
+++ b/bfd/linker.c
@@ -3025,6 +3025,8 @@ _bfd_generic_section_already_linked (bfd *abfd ATTRIBUTE_UNUSED,
   name = bfd_section_name (sec);
 
   already_linked_list = bfd_section_already_linked_table_lookup (name);
+  if (!already_linked_list)
+    goto bad;
 
   l = already_linked_list->entry;
   if (l != NULL)
@@ -3036,7 +3038,10 @@ _bfd_generic_section_already_linked (bfd *abfd ATTRIBUTE_UNUSED,
 
   /* This is the first section with this name.  Record it.  */
   if (!bfd_section_already_linked_table_insert (already_linked_list, sec))
-    info->callbacks->fatal (_("%P: already_linked_table: %E\n"));
+    {
+    bad:
+      info->callbacks->fatal (_("%P: already_linked_table: %E\n"));
+    }
   return false;
 }