binutils/dwarf.c debug_information leak It is possible with fuzzed files to have num_debug_info_entries zero after allocating space for debug_information, leading to multiple allocations. * dwarf.c (process_debug_info): Don't test num_debug_info_entries to determine whether debug_information has been allocated, test alloc_num_debug_info_entries.
diff --git a/binutils/dwarf.c b/binutils/dwarf.c index 8e004ce..bfbf83e 100644 --- a/binutils/dwarf.c +++ b/binutils/dwarf.c
@@ -3807,13 +3807,11 @@ } if ((do_loc || do_debug_loc || do_debug_ranges || do_debug_info) - && num_debug_info_entries == 0 - && ! do_types) + && alloc_num_debug_info_entries == 0 + && !do_types) { - /* Then allocate an array to hold the information. */ - debug_information = (debug_info *) cmalloc (num_units, - sizeof (* debug_information)); + debug_information = cmalloc (num_units, sizeof (*debug_information)); if (debug_information == NULL) { error (_("Not enough memory for a debug info array of %u entries\n"),