Fix illegal memory access when bfd_get_section_contents is called with a NULL section...

  PR 31843

diff --git a/bfd/section.c b/bfd/section.c
index 778a6f75160e191e88304a9a723d3666bb5d8ec3..81def037e6ad37926624fbec5129e7375626ad6c 100644 (file)
--- a/bfd/section.c
+++ b/bfd/section.c
@@ -1565,24 +1565,36 @@ bfd_get_section_contents (bfd *abfd,
 {
   bfd_size_type sz;
 
-  if (section->flags & SEC_CONSTRUCTOR)
+  if (count == 0)
+    /* Don't bother.  */
+    return true;
+
+  if (section == NULL)
     {
-      memset (location, 0, (size_t) count);
-      return true;
+      bfd_set_error (bfd_error_bad_value);
+      return false;
     }
 
-  sz = bfd_get_section_limit_octets (abfd, section);
-  if ((bfd_size_type) offset > sz
-      || count > sz - offset
-      || count != (size_t) count)
+  if (location == NULL)
     {
+      if (section->mmapped_p)
+       {
+         /* Pass this request straight on to the target's function.
+            All of the code below assumes that location != NULL.
+            FIXME: Should we still check that count is sane ?  */
+         return BFD_SEND (abfd, _bfd_get_section_contents,
+                          (abfd, section, location, offset, count));
+       }
+
       bfd_set_error (bfd_error_bad_value);
       return false;
     }
 
-  if (count == 0)
-    /* Don't bother.  */
-    return true;
+  if (section->flags & SEC_CONSTRUCTOR)
+    {
+      memset (location, 0, (size_t) count);
+      return true;
+    }
 
   if ((section->flags & SEC_HAS_CONTENTS) == 0)
     {
@@ -1590,6 +1602,18 @@ bfd_get_section_contents (bfd *abfd,
       return true;
     }
 
+  if (abfd == NULL)
+    return false;
+
+  sz = bfd_get_section_limit_octets (abfd, section);
+  if ((bfd_size_type) offset > sz
+      || count > sz - offset
+      || count != (size_t) count)
+    {
+      bfd_set_error (bfd_error_bad_value);
+      return false;
+    }
+
   if ((section->flags & SEC_IN_MEMORY) != 0)
     {
       if (section->contents == NULL)

diff --git a/opcodes/nfp-dis.c b/opcodes/nfp-dis.c
index 093c567100c08fa907207e206f31da66f93dd74e..ade5fd1d7ad104e17c6ffe898c15fe6ee3b92083 100644 (file)
--- a/opcodes/nfp-dis.c
+++ b/opcodes/nfp-dis.c
@@ -2559,6 +2559,13 @@ init_nfp3200_priv (nfp_priv_data * priv, struct disassemble_info *dinfo)
       return false;
     }
 
+  if (sec->bfd_section == NULL)
+    {
+      /* See PR 31843 for an example of this.  */
+      dinfo->fprintf_func (dinfo->stream, _("The ME-Config section is corrupt."));
+      return false;
+    }
+
   for (roff = 0; (bfd_size_type) roff < sec->sh_size;
        roff += sec->sh_entsize, menum_linear++)
     {