buffer overflow in cmdline_add_object_only_section

Seen running ld-plugin/lto-4r-c on x86_64-w64-mingw32

	* ldlang.c (cmdline_add_object_only_section): Allocate one more
	for output symbol buffer.

diff --git a/ld/ldlang.c b/ld/ldlang.c
index cf4294d7288a2d8d68f4aef538fc2b77b5c6591e..2e82eef61feaeba347abfba349687853571e0dc8 100644 (file)
--- a/ld/ldlang.c
+++ b/ld/ldlang.c
@@ -10728,7 +10728,7 @@ cmdline_add_object_only_section (bfd_byte *contents, size_t size)
       long src_count = 0, dst_count = 0;
       asymbol **from, **to;
 
-      osympp = (asymbol **) xmalloc (symcount * sizeof (asymbol *));
+      osympp = xmalloc ((symcount + 1) * sizeof (asymbol *));
       from = isympp;
       to = osympp;
       for (; src_count < symcount; src_count++)