Blob Blame History Raw
--- binutils.orig/bfd/dwarf2.c	2021-04-14 14:24:18.945917267 +0100
+++ binutils-2.30/bfd/dwarf2.c	2021-04-14 14:25:51.908614106 +0100
@@ -532,6 +532,10 @@ read_section (bfd *	      abfd,
   /* The section may have already been read.  */
   if (contents == NULL)
     {
+      bfd_size_type amt;
+      asection *msec;
+      ufile_ptr filesize;
+
       msec = bfd_get_section_by_name (abfd, section_name);
       if (! msec)
 	{
@@ -547,10 +551,22 @@ read_section (bfd *	      abfd,
 	  return FALSE;
 	}
 
-      *section_size = msec->rawsize ? msec->rawsize : msec->size;
+      amt = bfd_get_section_limit_octets (abfd, msec);
+      filesize = bfd_get_file_size (abfd);
+      if (amt >= filesize)
+       {
+         /* PR 26946 */
+         _bfd_error_handler (_("DWARF error: section %s is larger than its filesize! (0x%lx vs 0x%lx)"),
+                             section_name, (long) amt, (long) filesize);
+         bfd_set_error (bfd_error_bad_value);
+         return FALSE;
+       }
+      *section_size = amt;
+
       /* Paranoia - alloc one extra so that we can make sure a string
 	 section is NUL terminated.  */
-      amt = *section_size + 1;
+      amt += 1;
+
       if (amt == 0)
 	{
 	  bfd_set_error (bfd_error_no_memory);