X-Git-Url: http://git.efficios.com/?a=blobdiff_plain;f=binutils%2Frdcoff.c;h=7e585691eb6e13194fd14a303d1c464a3fabf8dd;hb=0d4e84ed37c404eb7e691ee9d68ae2ec758d8f66;hp=859aefe041da8bcec3c835b0bcb64d8b4d3cf946;hpb=4b95cf5c0c75d6efc1b2f96af72317aecca079f1;p=deliverable%2Fbinutils-gdb.git

diff --git a/binutils/rdcoff.c b/binutils/rdcoff.c
index 859aefe041..7e585691eb 100644
--- a/binutils/rdcoff.c
+++ b/binutils/rdcoff.c
@@ -1,5 +1,5 @@
 /* stabs.c -- Parse COFF debugging information
-   Copyright (C) 1996-2014 Free Software Foundation, Inc.
+   Copyright (C) 1996-2019 Free Software Foundation, Inc.
    Written by Ian Lance Taylor <ian@cygnus.com>.
 
    This file is part of GNU Binutils.
@@ -83,7 +83,7 @@ struct coff_types
   debug_type basic[T_MAX + 1];
 };
 
-static debug_type *coff_get_slot (struct coff_types *, int);
+static debug_type *coff_get_slot (struct coff_types *, long);
 static debug_type parse_coff_type
   (bfd *, struct coff_symbols *, struct coff_types *, long, int,
    union internal_auxent *, bfd_boolean, void *);
@@ -104,12 +104,17 @@ static bfd_boolean external_coff_symbol_p (int sym_class);
 /* Return the slot for a type.  */
 
 static debug_type *
-coff_get_slot (struct coff_types *types, int indx)
+coff_get_slot (struct coff_types *types, long indx)
 {
   struct coff_slots **pps;
 
   pps = &types->slots;
 
+  /* PR 17512: file: 078-18333-0.001:0.1.
+     FIXME: The value of 1000 is a guess.  Maybe a better heuristic is needed.  */
+  if (indx / COFF_SLOTS > 1000)
+    fatal (_("Excessively large slot index: %lx"), indx);
+
   while (indx >= COFF_SLOTS)
     {
       if (*pps == NULL)
@@ -404,6 +409,7 @@ parse_coff_struct_type (bfd *abfd, struct coff_symbols *symbols,
 	{
 	  non_fatal (_("bfd_coff_get_syment failed: %s"),
 		     bfd_errmsg (bfd_get_error ()));
+	  free (fields);
 	  return DEBUG_TYPE_NULL;
 	}
 
@@ -420,6 +426,7 @@ parse_coff_struct_type (bfd *abfd, struct coff_symbols *symbols,
 	    {
 	      non_fatal (_("bfd_coff_get_auxent failed: %s"),
 			 bfd_errmsg (bfd_get_error ()));
+	      free (fields);
 	      return DEBUG_TYPE_NULL;
 	    }
 	  psubaux = &auxent;
@@ -509,6 +516,8 @@ parse_coff_enum_type (bfd *abfd, struct coff_symbols *symbols,
 	{
 	  non_fatal (_("bfd_coff_get_syment failed: %s"),
 		     bfd_errmsg (bfd_get_error ()));
+	  free (names);
+	  free (vals);
 	  return DEBUG_TYPE_NULL;
 	}