FT32 initial support

[deliverable/binutils-gdb.git] / binutils / readelf.c

diff --git a/binutils/readelf.c b/binutils/readelf.c
index f7eaf7c97605395ad3c0fd29ee57372d0d3f63c0..e08d74e5ca2fd5d69124af56e63a1f6ccc8d7153 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -1,5 +1,5 @@
 /* readelf.c -- display contents of an ELF format file
 /* readelf.c -- display contents of an ELF format file

-   Copyright (C) 1998-2014 Free Software Foundation, Inc.
+   Copyright (C) 1998-2015 Free Software Foundation, Inc.

 
    Originally developed by Eric Youngdale <eric@andante.jic.com>
    Modifications by Nick Clifton <nickc@redhat.com>
 
    Originally developed by Eric Youngdale <eric@andante.jic.com>
    Modifications by Nick Clifton <nickc@redhat.com>


@@ -106,6 +106,7 @@
 #include "elf/epiphany.h"
 #include "elf/fr30.h"
 #include "elf/frv.h"
 #include "elf/epiphany.h"
 #include "elf/fr30.h"
 #include "elf/frv.h"

+#include "elf/ft32.h"

 #include "elf/h8.h"
 #include "elf/hppa.h"
 #include "elf/i386.h"
 #include "elf/h8.h"
 #include "elf/hppa.h"
 #include "elf/i386.h"


@@ -149,6 +150,7 @@
 #include "elf/tilepro.h"
 #include "elf/v850.h"
 #include "elf/vax.h"
 #include "elf/tilepro.h"
 #include "elf/v850.h"
 #include "elf/vax.h"

+#include "elf/visium.h"

 #include "elf/x86-64.h"
 #include "elf/xc16x.h"
 #include "elf/xgate.h"
 #include "elf/x86-64.h"
 #include "elf/xc16x.h"
 #include "elf/xgate.h"


@@ -165,11 +167,12 @@
 #endif
 
 char * program_name = "readelf";
 #endif
 
 char * program_name = "readelf";

-static long archive_file_offset;
+static unsigned long archive_file_offset;

 static unsigned long archive_file_size;
 static unsigned long archive_file_size;

+static bfd_size_type current_file_size;

 static unsigned long dynamic_addr;
 static bfd_size_type dynamic_size;
 static unsigned long dynamic_addr;
 static bfd_size_type dynamic_size;

-static unsigned int dynamic_nent;
+static size_t dynamic_nent;

 static char * dynamic_strings;
 static unsigned long dynamic_strings_length;
 static char * string_table;
 static char * dynamic_strings;
 static unsigned long dynamic_strings_length;
 static char * string_table;


@@ -271,6 +274,20 @@ typedef enum print_mode
 }
 print_mode;
 
 }
 print_mode;
 

+/* Versioned symbol info.  */
+enum versioned_symbol_info
+{
+  symbol_undefined,
+  symbol_hidden,
+  symbol_public
+};
+
+static const char *get_symbol_version_string
+  (FILE *file, int is_dynsym, const char *strtab,
+   unsigned long int strtab_size, unsigned int si,
+   Elf_Internal_Sym *psym, enum versioned_symbol_info *sym_info,
+   unsigned short *vna_other);
+

 #define UNKNOWN -1
 
 #define SECTION_NAME(X)                                                \
 #define UNKNOWN -1
 
 #define SECTION_NAME(X)                                                \


@@ -298,25 +315,40 @@ print_mode;
     }                                          \
   while (0)
 \f
     }                                          \
   while (0)
 \f

-/* Retrieve NMEMB structures, each SIZE bytes long from FILE starting at OFFSET.
+/* Retrieve NMEMB structures, each SIZE bytes long from FILE starting at OFFSET +
+   the offset of the current archive member, if we are examining an archive.

    Put the retrieved data into VAR, if it is not NULL.  Otherwise allocate a buffer
    using malloc and fill that.  In either case return the pointer to the start of
    the retrieved data or NULL if something went wrong.  If something does go wrong
    Put the retrieved data into VAR, if it is not NULL.  Otherwise allocate a buffer
    using malloc and fill that.  In either case return the pointer to the start of
    the retrieved data or NULL if something went wrong.  If something does go wrong

-   emit an error message using REASON as part of the context.  */
+   and REASON is not NULL then emit an error message using REASON as part of the
+   context.  */

 
 static void *
 
 static void *

-get_data (void * var, FILE * file, long offset, size_t size, size_t nmemb,
+get_data (void * var, FILE * file, unsigned long offset, size_t size, size_t nmemb,

          const char * reason)
 {
   void * mvar;
          const char * reason)
 {
   void * mvar;

+  size_t amt = size * nmemb;

 
   if (size == 0 || nmemb == 0)
     return NULL;
 
 
   if (size == 0 || nmemb == 0)
     return NULL;
 

+  /* Be kind to memory chekers (eg valgrind, address sanitizer) by not
+     attempting to allocate memory when the read is bound to fail.  */
+  if (amt > current_file_size
+      || offset + archive_file_offset + amt > current_file_size)
+    {
+      if (reason)
+       error (_("Reading 0x%lx bytes extends past end of file for %s\n"),
+              (unsigned long) amt, reason);
+      return NULL;
+    }
+

   if (fseek (file, archive_file_offset + offset, SEEK_SET))
     {
   if (fseek (file, archive_file_offset + offset, SEEK_SET))
     {

-      error (_("Unable to seek to 0x%lx for %s\n"),
-            (unsigned long) archive_file_offset + offset, reason);
+      if (reason)
+       error (_("Unable to seek to 0x%lx for %s\n"),
+              (unsigned long) archive_file_offset + offset, reason);

       return NULL;
     }
 
       return NULL;
     }
 


@@ -330,18 +362,20 @@ get_data (void * var, FILE * file, long offset, size_t size, size_t nmemb,
 
       if (mvar == NULL)
        {
 
       if (mvar == NULL)
        {

-         error (_("Out of memory allocating 0x%lx bytes for %s\n"),
-                (unsigned long)(size * nmemb), reason);
+         if (reason)
+           error (_("Out of memory allocating 0x%lx bytes for %s\n"),
+                  (unsigned long)(size * nmemb), reason);

          return NULL;
        }
 
          return NULL;
        }
 

-      ((char *) mvar)[size * nmemb] = '\0';
+      ((char *) mvar)[amt] = '\0';

     }
 
   if (fread (mvar, size, nmemb, file) != nmemb)
     {
     }
 
   if (fread (mvar, size, nmemb, file) != nmemb)
     {

-      error (_("Unable to read in 0x%lx bytes of %s\n"),
-            (unsigned long)(size * nmemb), reason);
+      if (reason)
+       error (_("Unable to read in 0x%lx bytes of %s\n"),
+              (unsigned long) amt, reason);

       if (mvar != var)
        free (mvar);
       return NULL;
       if (mvar != var)
        free (mvar);
       return NULL;


@@ -418,6 +452,7 @@ print_symbol (int width, const char *symbol)
       width = - width;
       extra_padding = TRUE;
     }
       width = - width;
       extra_padding = TRUE;
     }

+  assert (width != 0);

 
   if (do_wide)
     /* Set the remaining width to a very large value.
 
   if (do_wide)
     /* Set the remaining width to a very large value.


@@ -490,6 +525,66 @@ print_symbol (int width, const char *symbol)
   return num_printed;
 }
 
   return num_printed;
 }
 

+/* Returns a pointer to a static buffer containing a  printable version of
+   the given section's name.  Like print_symbol, except that it does not try
+   to print multibyte characters, it just interprets them as hex values.  */
+
+static const char *
+printable_section_name (Elf_Internal_Shdr * sec)
+{
+#define MAX_PRINT_SEC_NAME_LEN 128
+  static char  sec_name_buf [MAX_PRINT_SEC_NAME_LEN + 1];
+  const char * name = SECTION_NAME (sec);
+  char *       buf = sec_name_buf;
+  char         c;
+  unsigned int remaining = MAX_PRINT_SEC_NAME_LEN;
+
+  while ((c = * name ++) != 0)
+    {
+      if (ISCNTRL (c))
+       {
+         if (remaining < 2)
+           break;
+         
+         * buf ++ = '^';
+         * buf ++ = c + 0x40;
+         remaining -= 2;
+       }
+      else if (ISPRINT (c))
+       {
+         * buf ++ = c;
+         remaining -= 1;
+       }
+      else
+       {
+         static char hex[17] = "0123456789ABCDEF";
+
+         if (remaining < 4)
+           break;
+         * buf ++ = '<';
+         * buf ++ = hex[(c & 0xf0) >> 4];
+         * buf ++ = hex[c & 0x0f];
+         * buf ++ = '>';
+         remaining -= 4;
+       }
+
+      if (remaining == 0)
+       break;
+    }
+
+  * buf = 0;
+  return sec_name_buf;
+}
+
+static const char *
+printable_section_name_from_index (unsigned long ndx)
+{
+  if (ndx >= elf_header.e_shnum)
+    return _("<corrupt>");
+
+  return printable_section_name (section_headers + ndx);
+}
+

 /* Return a pointer to section NAME, or NULL if no such section exists.  */
 
 static Elf_Internal_Shdr *
 /* Return a pointer to section NAME, or NULL if no such section exists.  */
 
 static Elf_Internal_Shdr *


@@ -522,6 +617,21 @@ find_section_by_address (bfd_vma addr)
   return NULL;
 }
 
   return NULL;
 }
 

+static Elf_Internal_Shdr *
+find_section_by_type (unsigned int type)
+{
+  unsigned int i;
+
+  for (i = 0; i < elf_header.e_shnum; i++)
+    {
+      Elf_Internal_Shdr *sec = section_headers + i;
+      if (sec->sh_type == type)
+       return sec;
+    }
+
+  return NULL;
+}
+

 /* Return a pointer to section NAME, or NULL if no such section exists,
    restricted to the list of sections given in SET.  */
 
 /* Return a pointer to section NAME, or NULL if no such section exists,
    restricted to the list of sections given in SET.  */
 


@@ -600,6 +710,7 @@ guess_is_rela (unsigned int e_machine)
     case EM_D30V:
     case EM_CYGNUS_D30V:
     case EM_FR30:
     case EM_D30V:
     case EM_CYGNUS_D30V:
     case EM_FR30:

+    case EM_FT32:

     case EM_CYGNUS_FR30:
     case EM_CYGNUS_FRV:
     case EM_H8S:
     case EM_CYGNUS_FR30:
     case EM_CYGNUS_FRV:
     case EM_H8S:


@@ -646,6 +757,7 @@ guess_is_rela (unsigned int e_machine)
     case EM_V850:
     case EM_CYGNUS_V850:
     case EM_VAX:
     case EM_V850:
     case EM_CYGNUS_V850:
     case EM_VAX:

+    case EM_VISIUM:

     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:
     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:


@@ -687,7 +799,7 @@ slurp_rela_relocs (FILE * file,
                   unsigned long * nrelasp)
 {
   Elf_Internal_Rela * relas;
                   unsigned long * nrelasp)
 {
   Elf_Internal_Rela * relas;

-  unsigned long nrelas;
+  size_t nrelas;

   unsigned int i;
 
   if (is_32bit_elf)
   unsigned int i;
 
   if (is_32bit_elf)


@@ -785,7 +897,7 @@ slurp_rel_relocs (FILE * file,
                  unsigned long * nrelsp)
 {
   Elf_Internal_Rela * rels;
                  unsigned long * nrelsp)
 {
   Elf_Internal_Rela * rels;

-  unsigned long nrels;
+  size_t nrels;

   unsigned int i;
 
   if (is_32bit_elf)
   unsigned int i;
 
   if (is_32bit_elf)


@@ -925,7 +1037,8 @@ dump_relocations (FILE * file,
                  unsigned long nsyms,
                  char * strtab,
                  unsigned long strtablen,
                  unsigned long nsyms,
                  char * strtab,
                  unsigned long strtablen,

-                 int is_rela)
+                 int is_rela,
+                 int is_dynsym)

 {
   unsigned int i;
   Elf_Internal_Rela * rels;
 {
   unsigned int i;
   Elf_Internal_Rela * rels;


@@ -1123,6 +1236,10 @@ dump_relocations (FILE * file,
          rtype = elf_frv_reloc_type (type);
          break;
 
          rtype = elf_frv_reloc_type (type);
          break;
 

+       case EM_FT32:
+         rtype = elf_ft32_reloc_type (type);
+         break;
+

        case EM_MCORE:
          rtype = elf_mcore_reloc_type (type);
          break;
        case EM_MCORE:
          rtype = elf_mcore_reloc_type (type);
          break;


@@ -1235,6 +1352,10 @@ dump_relocations (FILE * file,
          rtype = elf_vax_reloc_type (type);
          break;
 
          rtype = elf_vax_reloc_type (type);
          break;
 

+       case EM_VISIUM:
+         rtype = elf_visium_reloc_type (type);
+         break;
+

        case EM_ADAPTEVA_EPIPHANY:
          rtype = elf_epiphany_reloc_type (type);
          break;
        case EM_ADAPTEVA_EPIPHANY:
          rtype = elf_epiphany_reloc_type (type);
          break;


@@ -1358,9 +1479,20 @@ dump_relocations (FILE * file,
          else
            {
              Elf_Internal_Sym * psym;
          else
            {
              Elf_Internal_Sym * psym;

+             const char * version_string;
+             enum versioned_symbol_info sym_info;
+             unsigned short vna_other;

 
              psym = symtab + symtab_index;
 
 
              psym = symtab + symtab_index;
 

+             version_string
+               = get_symbol_version_string (file, is_dynsym,
+                                            strtab, strtablen,
+                                            symtab_index,
+                                            psym,
+                                            &sym_info,
+                                            &vna_other);
+

              printf (" ");
 
              if (ELF_ST_TYPE (psym->st_info) == STT_GNU_IFUNC)
              printf (" ");
 
              if (ELF_ST_TYPE (psym->st_info) == STT_GNU_IFUNC)


@@ -1387,6 +1519,9 @@ dump_relocations (FILE * file,
                    name = strtab + psym->st_name;
 
                  len = print_symbol (width, name);
                    name = strtab + psym->st_name;
 
                  len = print_symbol (width, name);

+                 if (version_string)
+                   printf (sym_info == symbol_public ? "@@%s" : "@%s",
+                           version_string);

                  printf ("()%-*s", len <= width ? (width + 1) - len : 1, " ");
                }
              else
                  printf ("()%-*s", len <= width ? (width + 1) - len : 1, " ");
                }
              else


@@ -1404,8 +1539,7 @@ dump_relocations (FILE * file,
                  if (ELF_ST_TYPE (psym->st_info) == STT_SECTION)
                    {
                      if (psym->st_shndx < elf_header.e_shnum)
                  if (ELF_ST_TYPE (psym->st_info) == STT_SECTION)
                    {
                      if (psym->st_shndx < elf_header.e_shnum)

-                       sec_name
-                         = SECTION_NAME (section_headers + psym->st_shndx);
+                       sec_name = SECTION_NAME (section_headers + psym->st_shndx);

                      else if (psym->st_shndx == SHN_ABS)
                        sec_name = "ABS";
                      else if (psym->st_shndx == SHN_COMMON)
                      else if (psym->st_shndx == SHN_ABS)
                        sec_name = "ABS";
                      else if (psym->st_shndx == SHN_COMMON)


@@ -1444,7 +1578,12 @@ dump_relocations (FILE * file,
              else if (psym->st_name >= strtablen)
                printf (_("<corrupt string table index: %3ld>"), psym->st_name);
              else
              else if (psym->st_name >= strtablen)
                printf (_("<corrupt string table index: %3ld>"), psym->st_name);
              else

-               print_symbol (22, strtab + psym->st_name);
+               {
+                 print_symbol (22, strtab + psym->st_name);
+                 if (version_string)
+                   printf (sym_info == symbol_public ? "@@%s" : "@%s",
+                           version_string);
+               }

 
              if (is_rela)
                {
 
              if (is_rela)
                {


@@ -1939,6 +2078,7 @@ get_machine_name (unsigned e_machine)
     case EM_PPC:               return "PowerPC";
     case EM_PPC64:             return "PowerPC64";
     case EM_FR20:              return "Fujitsu FR20";
     case EM_PPC:               return "PowerPC";
     case EM_PPC64:             return "PowerPC64";
     case EM_FR20:              return "Fujitsu FR20";

+    case EM_FT32:              return "FTDI FT32";

     case EM_RH32:              return "TRW RH32";
     case EM_MCORE:             return "MCORE";
     case EM_ARM:               return "ARM";
     case EM_RH32:              return "TRW RH32";
     case EM_MCORE:             return "MCORE";
     case EM_ARM:               return "ARM";


@@ -1996,6 +2136,7 @@ get_machine_name (unsigned e_machine)
     case EM_SVX:               return "Silicon Graphics SVx";
     case EM_ST19:              return "STMicroelectronics ST19 8-bit microcontroller";
     case EM_VAX:               return "Digital VAX";
     case EM_SVX:               return "Silicon Graphics SVx";
     case EM_ST19:              return "STMicroelectronics ST19 8-bit microcontroller";
     case EM_VAX:               return "Digital VAX";

+    case EM_VISIUM:            return "CDS VISIUMcore processor";

     case EM_AVR_OLD:
     case EM_AVR:               return "Atmel AVR 8-bit microcontroller";
     case EM_CRIS:              return "Axis Communications 32-bit embedded processor";
     case EM_AVR_OLD:
     case EM_AVR:               return "Atmel AVR 8-bit microcontroller";
     case EM_CRIS:              return "Axis Communications 32-bit embedded processor";


@@ -2310,6 +2451,77 @@ decode_ARM_machine_flags (unsigned e_flags, char buf[])
     strcat (buf,_(", <unknown>"));
 }
 
     strcat (buf,_(", <unknown>"));
 }
 

+static void
+decode_AVR_machine_flags (unsigned e_flags, char buf[], size_t size)
+{
+  --size; /* Leave space for null terminator.  */
+
+  switch (e_flags & EF_AVR_MACH)
+    {
+    case E_AVR_MACH_AVR1:
+      strncat (buf, ", avr:1", size);
+      break;
+    case E_AVR_MACH_AVR2:
+      strncat (buf, ", avr:2", size);
+      break;
+    case E_AVR_MACH_AVR25:
+      strncat (buf, ", avr:25", size);
+      break;
+    case E_AVR_MACH_AVR3:
+      strncat (buf, ", avr:3", size);
+      break;
+    case E_AVR_MACH_AVR31:
+      strncat (buf, ", avr:31", size);
+      break;
+    case E_AVR_MACH_AVR35:
+      strncat (buf, ", avr:35", size);
+      break;
+    case E_AVR_MACH_AVR4:
+      strncat (buf, ", avr:4", size);
+      break;
+    case E_AVR_MACH_AVR5:
+      strncat (buf, ", avr:5", size);
+      break;
+    case E_AVR_MACH_AVR51:
+      strncat (buf, ", avr:51", size);
+      break;
+    case E_AVR_MACH_AVR6:
+      strncat (buf, ", avr:6", size);
+      break;
+    case E_AVR_MACH_AVRTINY:
+      strncat (buf, ", avr:100", size);
+      break;
+    case E_AVR_MACH_XMEGA1:
+      strncat (buf, ", avr:101", size);
+      break;
+    case E_AVR_MACH_XMEGA2:
+      strncat (buf, ", avr:102", size);
+      break;
+    case E_AVR_MACH_XMEGA3:
+      strncat (buf, ", avr:103", size);
+      break;
+    case E_AVR_MACH_XMEGA4:
+      strncat (buf, ", avr:104", size);
+      break;
+    case E_AVR_MACH_XMEGA5:
+      strncat (buf, ", avr:105", size);
+      break;
+    case E_AVR_MACH_XMEGA6:
+      strncat (buf, ", avr:106", size);
+      break;
+    case E_AVR_MACH_XMEGA7:
+      strncat (buf, ", avr:107", size);
+      break;
+    default:
+      strncat (buf, ", avr:<unknown>", size);
+      break;
+    }
+
+  size -= strlen (buf);
+  if (e_flags & EF_AVR_LINKRELAX_PREPARED)
+    strncat (buf, ", link-relax", size);
+}
+

 static void
 decode_NDS32_machine_flags (unsigned e_flags, char buf[], size_t size)
 {
 static void
 decode_NDS32_machine_flags (unsigned e_flags, char buf[], size_t size)
 {


@@ -2326,7 +2538,8 @@ decode_NDS32_machine_flags (unsigned e_flags, char buf[], size_t size)
     "ABI v1", /* use r0 as return register */
     "ABI v2", /* use r0 as return register and don't reserve 24 bytes for arguments */
     "ABI v2fp", /* for FPU */
     "ABI v1", /* use r0 as return register */
     "ABI v2", /* use r0 as return register and don't reserve 24 bytes for arguments */
     "ABI v2fp", /* for FPU */

-    "AABI"
+    "AABI",
+    "ABI2 FP+"

   };
   static const char *VER_STRINGS[] =
   {
   };
   static const char *VER_STRINGS[] =
   {


@@ -2357,6 +2570,7 @@ decode_NDS32_machine_flags (unsigned e_flags, char buf[], size_t size)
     case E_NDS_ABI_V2:
     case E_NDS_ABI_V2FP:
     case E_NDS_ABI_AABI:
     case E_NDS_ABI_V2:
     case E_NDS_ABI_V2FP:
     case E_NDS_ABI_AABI:

+    case E_NDS_ABI_V2FP_PLUS:

       /* In case there are holes in the array.  */
       r += snprintf (buf + r, size - r, ", %s", ABI_STRINGS[abi >> EF_NDS_ABI_SHIFT]);
       break;
       /* In case there are holes in the array.  */
       r += snprintf (buf + r, size - r, ", %s", ABI_STRINGS[abi >> EF_NDS_ABI_SHIFT]);
       break;


@@ -2529,6 +2743,10 @@ get_machine_flags (unsigned e_flags, unsigned e_machine)
          decode_ARM_machine_flags (e_flags, buf);
          break;
 
          decode_ARM_machine_flags (e_flags, buf);
          break;
 

+        case EM_AVR:
+          decode_AVR_machine_flags (e_flags, buf, sizeof buf);
+          break;
+

        case EM_BLACKFIN:
          if (e_flags & EF_BFIN_PIC)
            strcat (buf, ", PIC");
        case EM_BLACKFIN:
          if (e_flags & EF_BFIN_PIC)
            strcat (buf, ", PIC");


@@ -2994,7 +3212,9 @@ get_machine_flags (unsigned e_flags, unsigned e_machine)
                   strcat (buf, ", abort");
                   break;
                 default:
                   strcat (buf, ", abort");
                   break;
                 default:

-                  abort ();
+                 warn (_("Unrecognised IA64 VMS Command Code: %x\n"),
+                       e_flags & EF_IA_64_VMS_COMCOD);
+                 strcat (buf, ", <unknown>");

                 }
             }
          break;
                 }
             }
          break;


@@ -3008,6 +3228,15 @@ get_machine_flags (unsigned e_flags, unsigned e_machine)
            strcat (buf, ", G-Float");
          break;
 
            strcat (buf, ", G-Float");
          break;
 

+        case EM_VISIUM:
+         if (e_flags & EF_VISIUM_ARCH_MCM)
+           strcat (buf, ", mcm");
+         else if (e_flags & EF_VISIUM_ARCH_MCM24)
+           strcat (buf, ", mcm24");
+         if (e_flags & EF_VISIUM_ARCH_GR6)
+           strcat (buf, ", gr6");
+         break;
+

        case EM_RL78:
          if (e_flags & E_FLAG_RL78_G10)
            strcat (buf, ", G10");
        case EM_RL78:
          if (e_flags & E_FLAG_RL78_G10)
            strcat (buf, ", G10");


@@ -3104,6 +3333,7 @@ get_osabi_name (unsigned int osabi)
 
          case EM_MSP430:
          case EM_MSP430_OLD:
 
          case EM_MSP430:
          case EM_MSP430_OLD:

+         case EM_VISIUM:

            switch (osabi)
              {
              case ELFOSABI_STANDALONE: return _("Standalone App");
            switch (osabi)
              {
              case ELFOSABI_STANDALONE: return _("Standalone App");


@@ -4098,21 +4328,31 @@ process_file_header (void)
   return 1;
 }
 
   return 1;
 }
 

-
-static int
+static bfd_boolean

 get_32bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
 {
   Elf32_External_Phdr * phdrs;
   Elf32_External_Phdr * external;
   Elf_Internal_Phdr *   internal;
   unsigned int i;
 get_32bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
 {
   Elf32_External_Phdr * phdrs;
   Elf32_External_Phdr * external;
   Elf_Internal_Phdr *   internal;
   unsigned int i;

+  unsigned int size = elf_header.e_phentsize;
+  unsigned int num  = elf_header.e_phnum;
+
+  /* PR binutils/17531: Cope with unexpected section header sizes.  */
+  if (size == 0 || num == 0)
+    return FALSE;
+  if (size < sizeof * phdrs)
+    {
+      error (_("The e_phentsize field in the ELF header is less than the size of an ELF program header\n"));
+      return FALSE;
+    }
+  if (size > sizeof * phdrs)
+    warn (_("The e_phentsize field in the ELF header is larger than the size of an ELF program header\n"));

 
   phdrs = (Elf32_External_Phdr *) get_data (NULL, file, elf_header.e_phoff,
 
   phdrs = (Elf32_External_Phdr *) get_data (NULL, file, elf_header.e_phoff,

-                                            elf_header.e_phentsize,
-                                            elf_header.e_phnum,
-                                            _("program headers"));
-  if (!phdrs)
-    return 0;
+                                            size, num, _("program headers"));
+  if (phdrs == NULL)
+    return FALSE;

 
   for (i = 0, internal = pheaders, external = phdrs;
        i < elf_header.e_phnum;
 
   for (i = 0, internal = pheaders, external = phdrs;
        i < elf_header.e_phnum;


@@ -4129,24 +4369,34 @@ get_32bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
     }
 
   free (phdrs);
     }
 
   free (phdrs);

-
-  return 1;
+  return TRUE;

 }
 
 }
 

-static int
+static bfd_boolean

 get_64bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
 {
   Elf64_External_Phdr * phdrs;
   Elf64_External_Phdr * external;
   Elf_Internal_Phdr *   internal;
   unsigned int i;
 get_64bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
 {
   Elf64_External_Phdr * phdrs;
   Elf64_External_Phdr * external;
   Elf_Internal_Phdr *   internal;
   unsigned int i;

+  unsigned int size = elf_header.e_phentsize;
+  unsigned int num  = elf_header.e_phnum;
+
+  /* PR binutils/17531: Cope with unexpected section header sizes.  */
+  if (size == 0 || num == 0)
+    return FALSE;
+  if (size < sizeof * phdrs)
+    {
+      error (_("The e_phentsize field in the ELF header is less than the size of an ELF program header\n"));
+      return FALSE;
+    }
+  if (size > sizeof * phdrs)
+    warn (_("The e_phentsize field in the ELF header is larger than the size of an ELF program header\n"));

 
   phdrs = (Elf64_External_Phdr *) get_data (NULL, file, elf_header.e_phoff,
 
   phdrs = (Elf64_External_Phdr *) get_data (NULL, file, elf_header.e_phoff,

-                                            elf_header.e_phentsize,
-                                            elf_header.e_phnum,
-                                            _("program headers"));
+                                            size, num, _("program headers"));

   if (!phdrs)
   if (!phdrs)

-    return 0;
+    return FALSE;

 
   for (i = 0, internal = pheaders, external = phdrs;
        i < elf_header.e_phnum;
 
   for (i = 0, internal = pheaders, external = phdrs;
        i < elf_header.e_phnum;


@@ -4163,8 +4413,7 @@ get_64bit_program_headers (FILE * file, Elf_Internal_Phdr * pheaders)
     }
 
   free (phdrs);
     }
 
   free (phdrs);

-
-  return 1;
+  return TRUE;

 }
 
 /* Returns 1 if the program headers were read into `program_headers'.  */
 }
 
 /* Returns 1 if the program headers were read into `program_headers'.  */


@@ -4183,7 +4432,8 @@ get_program_headers (FILE * file)
 
   if (phdrs == NULL)
     {
 
   if (phdrs == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %u program headers\n"),
+            elf_header.e_phnum);

       return 0;
     }
 
       return 0;
     }
 


@@ -4339,6 +4589,9 @@ process_program_headers (FILE * file)
            }
        }
 
            }
        }
 

+      if (do_segments)
+       putc ('\n', stdout);
+

       switch (segment->p_type)
        {
        case PT_DYNAMIC:
       switch (segment->p_type)
        {
        case PT_DYNAMIC:


@@ -4349,6 +4602,12 @@ process_program_headers (FILE * file)
             section in the DYNAMIC segment.  */
          dynamic_addr = segment->p_offset;
          dynamic_size = segment->p_filesz;
             section in the DYNAMIC segment.  */
          dynamic_addr = segment->p_offset;
          dynamic_size = segment->p_filesz;

+         /* PR binutils/17512: Avoid corrupt dynamic section info in the segment.  */
+         if (dynamic_addr + dynamic_size >= current_file_size)
+           {
+             error (_("the dynamic segment offset + size exceeds the size of the file\n"));
+             dynamic_addr = dynamic_size = 0;
+           }

 
          /* Try to locate the .dynamic section. If there is
             a section header table, we can easily locate it.  */
 
          /* Try to locate the .dynamic section. If there is
             a section header table, we can easily locate it.  */


@@ -4392,7 +4651,7 @@ process_program_headers (FILE * file)
          else
            {
              char fmt [32];
          else
            {
              char fmt [32];

-             int ret = snprintf (fmt, sizeof (fmt), "%%%ds", PATH_MAX);
+             int ret = snprintf (fmt, sizeof (fmt), "%%%ds", PATH_MAX - 1);

 
              if (ret >= (int) sizeof (fmt) || ret < 0)
                error (_("Internal error: failed to create format string to display program interpreter\n"));
 
              if (ret >= (int) sizeof (fmt) || ret < 0)
                error (_("Internal error: failed to create format string to display program interpreter\n"));


@@ -4402,14 +4661,11 @@ process_program_headers (FILE * file)
                error (_("Unable to read program interpreter name\n"));
 
              if (do_segments)
                error (_("Unable to read program interpreter name\n"));
 
              if (do_segments)

-               printf (_("\n      [Requesting program interpreter: %s]"),
+               printf (_("      [Requesting program interpreter: %s]\n"),

                    program_interpreter);
            }
          break;
        }
                    program_interpreter);
            }
          break;
        }

-
-      if (do_segments)
-       putc ('\n', stdout);

     }
 
   if (do_segments && section_headers != NULL && string_table != NULL)
     }
 
   if (do_segments && section_headers != NULL && string_table != NULL)


@@ -4431,7 +4687,7 @@ process_program_headers (FILE * file)
            {
              if (!ELF_TBSS_SPECIAL (section, segment)
                  && ELF_SECTION_IN_SEGMENT_STRICT (section, segment))
            {
              if (!ELF_TBSS_SPECIAL (section, segment)
                  && ELF_SECTION_IN_SEGMENT_STRICT (section, segment))

-               printf ("%s ", SECTION_NAME (section));
+               printf ("%s ", printable_section_name (section));

            }
 
          putc ('\n',stdout);
            }
 
          putc ('\n',stdout);


@@ -4473,26 +4729,46 @@ offset_from_vma (FILE * file, bfd_vma vma, bfd_size_type size)
 }
 
 
 }
 
 

-static int
-get_32bit_section_headers (FILE * file, unsigned int num)
+/* Allocate memory and load the sections headers into the global pointer
+   SECTION_HEADERS.  If PROBE is true, this is just a probe and we do not
+   generate any error messages if the load fails.  */
+
+static bfd_boolean
+get_32bit_section_headers (FILE * file, bfd_boolean probe)

 {
   Elf32_External_Shdr * shdrs;
   Elf_Internal_Shdr *   internal;
   unsigned int i;
 {
   Elf32_External_Shdr * shdrs;
   Elf_Internal_Shdr *   internal;
   unsigned int i;

+  unsigned int size = elf_header.e_shentsize;
+  unsigned int num = probe ? 1 : elf_header.e_shnum;
+
+  /* PR binutils/17531: Cope with unexpected section header sizes.  */
+  if (size == 0 || num == 0)
+    return FALSE;
+  if (size < sizeof * shdrs)
+    {
+      if (! probe)
+       error (_("The e_shentsize field in the ELF header is less than the size of an ELF section header\n"));
+      return FALSE;
+    }
+  if (!probe && size > sizeof * shdrs)
+    warn (_("The e_shentsize field in the ELF header is larger than the size of an ELF section header\n"));

 
   shdrs = (Elf32_External_Shdr *) get_data (NULL, file, elf_header.e_shoff,
 
   shdrs = (Elf32_External_Shdr *) get_data (NULL, file, elf_header.e_shoff,

-                                            elf_header.e_shentsize, num,
-                                            _("section headers"));
-  if (!shdrs)
-    return 0;
+                                            size, num,
+                                           probe ? NULL : _("section headers"));
+  if (shdrs == NULL)
+    return FALSE;

 
 

+  if (section_headers != NULL)
+    free (section_headers);

   section_headers = (Elf_Internal_Shdr *) cmalloc (num,
                                                    sizeof (Elf_Internal_Shdr));
   section_headers = (Elf_Internal_Shdr *) cmalloc (num,
                                                    sizeof (Elf_Internal_Shdr));

-

   if (section_headers == NULL)
     {
   if (section_headers == NULL)
     {

-      error (_("Out of memory\n"));
-      return 0;
+      if (!probe)
+       error (_("Out of memory reading %u section headers\n"), num);
+      return FALSE;

     }
 
   for (i = 0, internal = section_headers;
     }
 
   for (i = 0, internal = section_headers;


@@ -4512,30 +4788,45 @@ get_32bit_section_headers (FILE * file, unsigned int num)
     }
 
   free (shdrs);
     }
 
   free (shdrs);

-
-  return 1;
+  return TRUE;

 }
 
 }
 

-static int
-get_64bit_section_headers (FILE * file, unsigned int num)
+static bfd_boolean
+get_64bit_section_headers (FILE * file, bfd_boolean probe)

 {
   Elf64_External_Shdr * shdrs;
   Elf_Internal_Shdr *   internal;
   unsigned int i;
 {
   Elf64_External_Shdr * shdrs;
   Elf_Internal_Shdr *   internal;
   unsigned int i;

+  unsigned int size = elf_header.e_shentsize;
+  unsigned int num = probe ? 1 : elf_header.e_shnum;
+
+  /* PR binutils/17531: Cope with unexpected section header sizes.  */
+  if (size == 0 || num == 0)
+    return FALSE;
+  if (size < sizeof * shdrs)
+    {
+      if (! probe)
+       error (_("The e_shentsize field in the ELF header is less than the size of an ELF section header\n"));
+      return FALSE;
+    }
+  if (! probe && size > sizeof * shdrs)
+    warn (_("The e_shentsize field in the ELF header is larger than the size of an ELF section header\n"));

 
   shdrs = (Elf64_External_Shdr *) get_data (NULL, file, elf_header.e_shoff,
 
   shdrs = (Elf64_External_Shdr *) get_data (NULL, file, elf_header.e_shoff,

-                                            elf_header.e_shentsize, num,
-                                            _("section headers"));
-  if (!shdrs)
-    return 0;
+                                            size, num,
+                                           probe ? NULL : _("section headers"));
+  if (shdrs == NULL)
+    return FALSE;

 
 

+  if (section_headers != NULL)
+    free (section_headers);

   section_headers = (Elf_Internal_Shdr *) cmalloc (num,
                                                    sizeof (Elf_Internal_Shdr));
   section_headers = (Elf_Internal_Shdr *) cmalloc (num,
                                                    sizeof (Elf_Internal_Shdr));

-

   if (section_headers == NULL)
     {
   if (section_headers == NULL)
     {

-      error (_("Out of memory\n"));
-      return 0;
+      if (! probe)
+       error (_("Out of memory reading %u section headers\n"), num);
+      return FALSE;

     }
 
   for (i = 0, internal = section_headers;
     }
 
   for (i = 0, internal = section_headers;


@@ -4555,8 +4846,7 @@ get_64bit_section_headers (FILE * file, unsigned int num)
     }
 
   free (shdrs);
     }
 
   free (shdrs);

-
-  return 1;
+  return TRUE;

 }
 
 static Elf_Internal_Sym *
 }
 
 static Elf_Internal_Sym *


@@ -4571,10 +4861,25 @@ get_32bit_elf_symbols (FILE * file,
   Elf_Internal_Sym * psym;
   unsigned int j;
 
   Elf_Internal_Sym * psym;
   unsigned int j;
 

+  if (section->sh_size == 0)
+    {
+      if (num_syms_return != NULL)
+       * num_syms_return = 0;
+      return NULL;
+    }
+

   /* Run some sanity checks first.  */
   /* Run some sanity checks first.  */

-  if (section->sh_entsize == 0)
+  if (section->sh_entsize == 0 || section->sh_entsize > section->sh_size)
+    {
+      error (_("Section %s has an invalid sh_entsize of 0x%lx\n"),
+            printable_section_name (section), (unsigned long) section->sh_entsize);
+      goto exit_point;
+    }
+
+  if (section->sh_size > current_file_size)

     {
     {

-      error (_("sh_entsize is zero\n"));
+      error (_("Section %s has an invalid sh_size of 0x%lx\n"),
+            printable_section_name (section), (unsigned long) section->sh_size);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4582,7 +4887,10 @@ get_32bit_elf_symbols (FILE * file,
 
   if (number * sizeof (Elf32_External_Sym) > section->sh_size + 1)
     {
 
   if (number * sizeof (Elf32_External_Sym) > section->sh_size + 1)
     {

-      error (_("Invalid sh_entsize\n"));
+      error (_("Size (0x%lx) of section %s is not a multiple of its sh_entsize (0x%lx)\n"),
+            (unsigned long) section->sh_size,
+            printable_section_name (section),
+            (unsigned long) section->sh_entsize);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4602,13 +4910,23 @@ get_32bit_elf_symbols (FILE * file,
                                                    _("symbol table section indicies"));
       if (shndx == NULL)
        goto exit_point;
                                                    _("symbol table section indicies"));
       if (shndx == NULL)
        goto exit_point;

+      /* PR17531: file: heap-buffer-overflow */
+      else if (symtab_shndx_hdr->sh_size / sizeof (Elf_External_Sym_Shndx) < number)
+       {
+         error (_("Index section %s has an sh_size of 0x%lx - expected 0x%lx\n"),
+                printable_section_name (symtab_shndx_hdr),
+                (unsigned long) symtab_shndx_hdr->sh_size,
+                (unsigned long) section->sh_size);
+         goto exit_point;
+       }

     }
 
   isyms = (Elf_Internal_Sym *) cmalloc (number, sizeof (Elf_Internal_Sym));
 
   if (isyms == NULL)
     {
     }
 
   isyms = (Elf_Internal_Sym *) cmalloc (number, sizeof (Elf_Internal_Sym));
 
   if (isyms == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %lu symbols\n"),
+            (unsigned long) number);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4651,10 +4969,27 @@ get_64bit_elf_symbols (FILE * file,
   Elf_Internal_Sym * psym;
   unsigned int j;
 
   Elf_Internal_Sym * psym;
   unsigned int j;
 

+  if (section->sh_size == 0)
+    {
+      if (num_syms_return != NULL)
+       * num_syms_return = 0;
+      return NULL;
+    }
+

   /* Run some sanity checks first.  */
   /* Run some sanity checks first.  */

-  if (section->sh_entsize == 0)
+  if (section->sh_entsize == 0 || section->sh_entsize > section->sh_size)
+    {
+      error (_("Section %s has an invalid sh_entsize of 0x%lx\n"),
+            printable_section_name (section),
+            (unsigned long) section->sh_entsize);
+      goto exit_point;
+    }
+
+  if (section->sh_size > current_file_size)

     {
     {

-      error (_("sh_entsize is zero\n"));
+      error (_("Section %s has an invalid sh_size of 0x%lx\n"),
+            printable_section_name (section),
+            (unsigned long) section->sh_size);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4662,7 +4997,10 @@ get_64bit_elf_symbols (FILE * file,
 
   if (number * sizeof (Elf64_External_Sym) > section->sh_size + 1)
     {
 
   if (number * sizeof (Elf64_External_Sym) > section->sh_size + 1)
     {

-      error (_("Invalid sh_entsize\n"));
+      error (_("Size (0x%lx) of section %s is not a multiple of its sh_entsize (0x%lx)\n"),
+            (unsigned long) section->sh_size,
+            printable_section_name (section),
+            (unsigned long) section->sh_entsize);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4681,13 +5019,22 @@ get_64bit_elf_symbols (FILE * file,
                                                    _("symbol table section indicies"));
       if (shndx == NULL)
        goto exit_point;
                                                    _("symbol table section indicies"));
       if (shndx == NULL)
        goto exit_point;

+      else if (symtab_shndx_hdr->sh_size / sizeof (Elf_External_Sym_Shndx) < number)
+       {
+         error (_("Index section %s has an sh_size of 0x%lx - expected 0x%lx\n"),
+                printable_section_name (symtab_shndx_hdr),
+                (unsigned long) symtab_shndx_hdr->sh_size,
+                (unsigned long) section->sh_size);
+         goto exit_point;
+       }

     }
 
   isyms = (Elf_Internal_Sym *) cmalloc (number, sizeof (Elf_Internal_Sym));
 
   if (isyms == NULL)
     {
     }
 
   isyms = (Elf_Internal_Sym *) cmalloc (number, sizeof (Elf_Internal_Sym));
 
   if (isyms == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %lu symbols\n"),
+            (unsigned long) number);

       goto exit_point;
     }
 
       goto exit_point;
     }
 


@@ -4840,7 +5187,10 @@ get_elf_section_flags (bfd_vma sh_flags)
              if (p != buff + field_size + 4)
                {
                  if (size < (10 + 2))
              if (p != buff + field_size + 4)
                {
                  if (size < (10 + 2))

-                   abort ();
+                   {
+                     warn (_("Internal error: not enough buffer room for section flag info"));
+                     return _("<unknown>");
+                   }

                  size -= 2;
                  *p++ = ',';
                  *p++ = ' ';
                  size -= 2;
                  *p++ = ',';
                  *p++ = ' ';


@@ -4904,7 +5254,10 @@ get_elf_section_flags (bfd_vma sh_flags)
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))

-               abort ();
+               {
+                 warn (_("Internal error: not enough buffer room for section flag info"));
+                 return _("<unknown>");
+               }

              size -= 2;
              *p++ = ',';
              *p++ = ' ';
              size -= 2;
              *p++ = ',';
              *p++ = ' ';


@@ -4919,7 +5272,10 @@ get_elf_section_flags (bfd_vma sh_flags)
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))

-               abort ();
+               {
+                 warn (_("Internal error: not enough buffer room for section flag info"));
+                 return _("<unknown>");
+               }

              size -= 2;
              *p++ = ',';
              *p++ = ' ';
              size -= 2;
              *p++ = ',';
              *p++ = ' ';


@@ -4934,7 +5290,10 @@ get_elf_section_flags (bfd_vma sh_flags)
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))
          if (p != buff + field_size + 4)
            {
              if (size < (2 + 1))

-               abort ();
+               {
+                 warn (_("Internal error: not enough buffer room for section flag info"));
+                 return _("<unknown>");
+               }

              size -= 2;
              *p++ = ',';
              *p++ = ' ';
              size -= 2;
              *p++ = ',';
              *p++ = ' ';


@@ -4975,10 +5334,10 @@ process_section_headers (FILE * file)
 
   if (is_32bit_elf)
     {
 
   if (is_32bit_elf)
     {

-      if (! get_32bit_section_headers (file, elf_header.e_shnum))
+      if (! get_32bit_section_headers (file, FALSE))

        return 0;
     }
        return 0;
     }

-  else if (! get_64bit_section_headers (file, elf_header.e_shnum))
+  else if (! get_64bit_section_headers (file, FALSE))

     return 0;
 
   /* Read in the string table, so that we have names to display.  */
     return 0;
 
   /* Read in the string table, so that we have names to display.  */


@@ -5052,19 +5411,22 @@ process_section_headers (FILE * file)
       break;
     }
 
       break;
     }
 

-#define CHECK_ENTSIZE_VALUES(section, i, size32, size64) \
-  do                                                                       \
-    {                                                                      \
-      bfd_size_type expected_entsize = is_32bit_elf ? size32 : size64;     \
-      if (section->sh_entsize != expected_entsize)                         \
+#define CHECK_ENTSIZE_VALUES(section, i, size32, size64)               \
+  do                                                                   \
+    {                                                                  \
+      bfd_size_type expected_entsize = is_32bit_elf ? size32 : size64; \
+      if (section->sh_entsize != expected_entsize)                     \

        {                                                               \
        {                                                               \

-         error (_("Section %d has invalid sh_entsize of %" BFD_VMA_FMT "x\n"), \
-                i, section->sh_entsize);       \
-         error (_("(Using the expected size of %d for the rest of this dump)\n"), \
-                  (int) expected_entsize); \
+         char buf[40];                                                 \
+         sprintf_vma (buf, section->sh_entsize);                       \
+         /* Note: coded this way so that there is a single string for  \
+            translation.  */ \
+         error (_("Section %d has invalid sh_entsize of %s\n"), i, buf); \
+         error (_("(Using the expected size of %u for the rest of this dump)\n"), \
+                  (unsigned) expected_entsize);                        \

          section->sh_entsize = expected_entsize;                       \
          section->sh_entsize = expected_entsize;                       \

-       } \
-    }                                                                      \
+       }                                                               \
+    }                                                                  \

   while (0)
 
 #define CHECK_ENTSIZE(section, i, type)                                        \
   while (0)
 
 #define CHECK_ENTSIZE(section, i, type)                                        \


@@ -5177,7 +5539,6 @@ process_section_headers (FILE * file)
              )
            request_dump_bynumber (i, DEBUG_DUMP);
        }
              )
            request_dump_bynumber (i, DEBUG_DUMP);
        }

-

     }
 
   if (! do_sections)
     }
 
   if (! do_sections)


@@ -5234,14 +5595,9 @@ process_section_headers (FILE * file)
     {
       printf ("  [%2u] ", i);
       if (do_section_details)
     {
       printf ("  [%2u] ", i);
       if (do_section_details)

-       {
-         print_symbol (INT_MAX, SECTION_NAME (section));
-         printf ("\n      ");
-       }
+       printf ("%s\n      ", printable_section_name (section));

       else
       else

-       {
-         print_symbol (-17, SECTION_NAME (section));
-       }
+       print_symbol (-17, SECTION_NAME (section));

 
       printf (do_wide ? " %-15s " : " %-15.15s ",
              get_section_type_name (section->sh_type));
 
       printf (do_wide ? " %-15s " : " %-15.15s ",
              get_section_type_name (section->sh_type));


@@ -5474,7 +5830,8 @@ process_section_groups (FILE * file)
 
   if (section_headers_groups == NULL)
     {
 
   if (section_headers_groups == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %u section group headers\n"),
+            elf_header.e_shnum);

       return 0;
     }
 
       return 0;
     }
 


@@ -5498,7 +5855,8 @@ process_section_groups (FILE * file)
 
   if (section_groups == NULL)
     {
 
   if (section_groups == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %lu groups\n"),
+            (unsigned long) group_count);

       return 0;
     }
 
       return 0;
     }
 


@@ -5514,8 +5872,8 @@ process_section_groups (FILE * file)
     {
       if (section->sh_type == SHT_GROUP)
        {
     {
       if (section->sh_type == SHT_GROUP)
        {

-         char * name = SECTION_NAME (section);
-         char * group_name;
+         const char * name = printable_section_name (section);
+         const char * group_name;

          unsigned char * start;
          unsigned char * indices;
          unsigned int entry, j, size;
          unsigned char * start;
          unsigned char * indices;
          unsigned int entry, j, size;


@@ -5586,15 +5944,26 @@ process_section_groups (FILE * file)
                  strtab_sec = sec;
                  if (strtab)
                    free (strtab);
                  strtab_sec = sec;
                  if (strtab)
                    free (strtab);

+

                  strtab = (char *) get_data (NULL, file, strtab_sec->sh_offset,
                  strtab = (char *) get_data (NULL, file, strtab_sec->sh_offset,

-                                              1, strtab_sec->sh_size,
-                                              _("string table"));
+                                             1, strtab_sec->sh_size,
+                                             _("string table"));

                  strtab_size = strtab != NULL ? strtab_sec->sh_size : 0;
                }
              group_name = sym->st_name < strtab_size
                ? strtab + sym->st_name : _("<corrupt>");
            }
 
                  strtab_size = strtab != NULL ? strtab_sec->sh_size : 0;
                }
              group_name = sym->st_name < strtab_size
                ? strtab + sym->st_name : _("<corrupt>");
            }
 

+         /* PR 17531: file: loop.  */
+         if (section->sh_entsize > section->sh_size)
+           {
+             error (_("Section %s has sh_entsize (0x%lx) which is larger than its size (0x%lx)\n"),
+                    printable_section_name (section),
+                    (unsigned long) section->sh_entsize,
+                    (unsigned long) section->sh_size);
+             break;
+           }
+

          start = (unsigned char *) get_data (NULL, file, section->sh_offset,
                                               1, section->sh_size,
                                               _("section data"));
          start = (unsigned char *) get_data (NULL, file, section->sh_offset,
                                               1, section->sh_size,
                                               _("section data"));


@@ -5659,7 +6028,7 @@ process_section_groups (FILE * file)
              if (do_section_groups)
                {
                  sec = section_headers + entry;
              if (do_section_groups)
                {
                  sec = section_headers + entry;

-                 printf ("   [%5u]   %s\n", entry, SECTION_NAME (sec));
+                 printf ("   [%5u]   %s\n", entry, printable_section_name (sec));

                }
 
              g = (struct group_list *) xmalloc (sizeof (struct group_list));
                }
 
              g = (struct group_list *) xmalloc (sizeof (struct group_list));


@@ -5930,7 +6299,8 @@ process_relocs (FILE * file)
                                offset_from_vma (file, rel_offset, rel_size),
                                rel_size,
                                dynamic_symbols, num_dynamic_syms,
                                offset_from_vma (file, rel_offset, rel_size),
                                rel_size,
                                dynamic_symbols, num_dynamic_syms,

-                               dynamic_strings, dynamic_strings_length, is_rela);
+                               dynamic_strings, dynamic_strings_length,
+                               is_rela, 1);

            }
        }
 
            }
        }
 


@@ -5967,7 +6337,7 @@ process_relocs (FILE * file)
              if (string_table == NULL)
                printf ("%d", section->sh_name);
              else
              if (string_table == NULL)
                printf ("%d", section->sh_name);
              else

-               printf ("'%s'", SECTION_NAME (section));
+               printf ("'%s'", printable_section_name (section));

 
              printf (_(" at offset 0x%lx contains %lu entries:\n"),
                 rel_offset, (unsigned long) (rel_size / section->sh_entsize));
 
              printf (_(" at offset 0x%lx contains %lu entries:\n"),
                 rel_offset, (unsigned long) (rel_size / section->sh_entsize));


@@ -5999,20 +6369,22 @@ process_relocs (FILE * file)
                      strsec = section_headers + symsec->sh_link;
 
                      strtab = (char *) get_data (NULL, file, strsec->sh_offset,
                      strsec = section_headers + symsec->sh_link;
 
                      strtab = (char *) get_data (NULL, file, strsec->sh_offset,

-                                                  1, strsec->sh_size,
-                                                  _("string table"));
+                                                 1, strsec->sh_size,
+                                                 _("string table"));

                      strtablen = strtab == NULL ? 0 : strsec->sh_size;
                    }
 
                  dump_relocations (file, rel_offset, rel_size,
                      strtablen = strtab == NULL ? 0 : strsec->sh_size;
                    }
 
                  dump_relocations (file, rel_offset, rel_size,

-                                   symtab, nsyms, strtab, strtablen, is_rela);
+                                   symtab, nsyms, strtab, strtablen,
+                                   is_rela,
+                                   symsec->sh_type == SHT_DYNSYM);

                  if (strtab)
                    free (strtab);
                  free (symtab);
                }
              else
                dump_relocations (file, rel_offset, rel_size,
                  if (strtab)
                    free (strtab);
                  free (symtab);
                }
              else
                dump_relocations (file, rel_offset, rel_size,

-                                 NULL, 0, NULL, 0, is_rela);
+                                 NULL, 0, NULL, 0, is_rela, 0);

 
              found = 1;
            }
 
              found = 1;
            }


@@ -6125,6 +6497,7 @@ dump_ia64_unwind (struct ia64_unw_aux_info * aux)
       bfd_vma offset;
       const unsigned char * dp;
       const unsigned char * head;
       bfd_vma offset;
       const unsigned char * dp;
       const unsigned char * head;

+      const unsigned char * end;

       const char * procname;
 
       find_symbol_for_address (aux->symtab, aux->nsyms, aux->strtab,
       const char * procname;
 
       find_symbol_for_address (aux->symtab, aux->nsyms, aux->strtab,


@@ -6147,6 +6520,18 @@ dump_ia64_unwind (struct ia64_unw_aux_info * aux)
       printf ("], info at +0x%lx\n",
              (unsigned long) (tp->info.offset - aux->seg_base));
 
       printf ("], info at +0x%lx\n",
              (unsigned long) (tp->info.offset - aux->seg_base));
 

+      /* PR 17531: file: 86232b32.  */
+      if (aux->info == NULL)
+       continue;
+
+      /* PR 17531: file: 0997b4d1.  */
+      if ((ABSADDR (tp->info) - aux->info_addr) >= aux->info_size)
+       {
+         warn (_("Invalid offset %lx in table entry %ld\n"),
+               (long) tp->info.offset, (long) (tp - aux->table));
+         continue;
+       }
+

       head = aux->info + (ABSADDR (tp->info) - aux->info_addr);
       stamp = byte_get ((unsigned char *) head, sizeof (stamp));
 
       head = aux->info + (ABSADDR (tp->info) - aux->info_addr);
       stamp = byte_get ((unsigned char *) head, sizeof (stamp));
 


@@ -6164,12 +6549,16 @@ dump_ia64_unwind (struct ia64_unw_aux_info * aux)
        }
 
       in_body = 0;
        }
 
       in_body = 0;

-      for (dp = head + 8; dp < head + 8 + eh_addr_size * UNW_LENGTH (stamp);)
+      end = head + 8 + eh_addr_size * UNW_LENGTH (stamp);
+      /* PR 17531: file: 16ceda89.  */
+      if (end > aux->info + aux->info_size)
+       end = aux->info + aux->info_size;
+      for (dp = head + 8; dp < end;)

        dp = unw_decode (dp, in_body, & in_body);
     }
 }
 
        dp = unw_decode (dp, in_body, & in_body);
     }
 }
 

-static int
+static bfd_boolean

 slurp_ia64_unwind_table (FILE * file,
                         struct ia64_unw_aux_info * aux,
                         Elf_Internal_Shdr * sec)
 slurp_ia64_unwind_table (FILE * file,
                         struct ia64_unw_aux_info * aux,
                         Elf_Internal_Shdr * sec)


@@ -6185,13 +6574,15 @@ slurp_ia64_unwind_table (FILE * file,
   Elf_Internal_Sym * sym;
   const char * relname;
 
   Elf_Internal_Sym * sym;
   const char * relname;
 

+  aux->table_len = 0;
+

   /* First, find the starting address of the segment that includes
      this section: */
 
   if (elf_header.e_phnum)
     {
       if (! get_program_headers (file))
   /* First, find the starting address of the segment that includes
      this section: */
 
   if (elf_header.e_phnum)
     {
       if (! get_program_headers (file))

-         return 0;
+         return FALSE;

 
       for (seg = program_headers;
           seg < program_headers + elf_header.e_phnum;
 
       for (seg = program_headers;
           seg < program_headers + elf_header.e_phnum;


@@ -6214,12 +6605,14 @@ slurp_ia64_unwind_table (FILE * file,
   table = (unsigned char *) get_data (NULL, file, sec->sh_offset, 1, size,
                                       _("unwind table"));
   if (!table)
   table = (unsigned char *) get_data (NULL, file, sec->sh_offset, 1, size,
                                       _("unwind table"));
   if (!table)

-    return 0;
+    return FALSE;

 
 

+  aux->table_len = size / (3 * eh_addr_size);

   aux->table = (struct ia64_unw_table_entry *)
   aux->table = (struct ia64_unw_table_entry *)

-      xcmalloc (size / (3 * eh_addr_size), sizeof (aux->table[0]));
+    xcmalloc (aux->table_len, sizeof (aux->table[0]));

   tep = aux->table;
   tep = aux->table;

-  for (tp = table; tp < table + size; ++tep)
+
+  for (tp = table; tp <= table + size - (3 * eh_addr_size); ++tep)

     {
       tep->start.section = SHN_UNDEF;
       tep->end.section   = SHN_UNDEF;
     {
       tep->start.section = SHN_UNDEF;
       tep->end.section   = SHN_UNDEF;


@@ -6245,22 +6638,41 @@ slurp_ia64_unwind_table (FILE * file,
 
       if (!slurp_rela_relocs (file, relsec->sh_offset, relsec->sh_size,
                              & rela, & nrelas))
 
       if (!slurp_rela_relocs (file, relsec->sh_offset, relsec->sh_size,
                              & rela, & nrelas))

-       return 0;
+       {
+         free (aux->table);
+         aux->table = NULL;
+         aux->table_len = 0;
+         return FALSE;
+       }

 
       for (rp = rela; rp < rela + nrelas; ++rp)
        {
          relname = elf_ia64_reloc_type (get_reloc_type (rp->r_info));
          sym = aux->symtab + get_reloc_symindex (rp->r_info);
 
 
       for (rp = rela; rp < rela + nrelas; ++rp)
        {
          relname = elf_ia64_reloc_type (get_reloc_type (rp->r_info));
          sym = aux->symtab + get_reloc_symindex (rp->r_info);
 

+         /* PR 17531: file: 9fa67536.  */
+         if (relname == NULL)
+           {
+             warn (_("Skipping unknown relocation type: %u\n"), get_reloc_type (rp->r_info));
+             continue;
+           }
+ 

          if (! const_strneq (relname, "R_IA64_SEGREL"))
            {
          if (! const_strneq (relname, "R_IA64_SEGREL"))
            {

-             warn (_("Skipping unexpected relocation type %s\n"), relname);
+             warn (_("Skipping unexpected relocation type: %s\n"), relname);

              continue;
            }
 
          i = rp->r_offset / (3 * eh_addr_size);
 
              continue;
            }
 
          i = rp->r_offset / (3 * eh_addr_size);
 

-         switch (rp->r_offset/eh_addr_size % 3)
+         /* PR 17531: file: 5bc8d9bf.  */
+         if (i >= aux->table_len)
+           {
+             warn (_("Skipping reloc with overlarge offset: %lx\n"), i);
+             continue;
+           }
+
+         switch (rp->r_offset / eh_addr_size % 3)

            {
            case 0:
              aux->table[i].start.section = sym->st_shndx;
            {
            case 0:
              aux->table[i].start.section = sym->st_shndx;


@@ -6282,8 +6694,7 @@ slurp_ia64_unwind_table (FILE * file,
       free (rela);
     }
 
       free (rela);
     }
 

-  aux->table_len = size / (3 * eh_addr_size);
-  return 1;
+  return TRUE;

 }
 
 static void
 }
 
 static void


@@ -6305,7 +6716,11 @@ ia64_process_unwind (FILE * file)
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;

-         assert (aux.strtab == NULL);
+         if (aux.strtab != NULL)
+           {
+             error (_("Multiple auxillary string tables encountered\n"));
+             free (aux.strtab);
+           }

          aux.strtab = (char *) get_data (NULL, file, strsec->sh_offset,
                                           1, strsec->sh_size,
                                           _("string table"));
          aux.strtab = (char *) get_data (NULL, file, strsec->sh_offset,
                                           1, strsec->sh_size,
                                           _("string table"));


@@ -6323,13 +6738,16 @@ ia64_process_unwind (FILE * file)
       char * suffix;
       size_t len, len2;
 
       char * suffix;
       size_t len, len2;
 

-      for (i = unwstart, sec = section_headers + unwstart;
+      for (i = unwstart, sec = section_headers + unwstart, unwsec = NULL;

           i < elf_header.e_shnum; ++i, ++sec)
        if (sec->sh_type == SHT_IA_64_UNWIND)
          {
            unwsec = sec;
            break;
          }
           i < elf_header.e_shnum; ++i, ++sec)
        if (sec->sh_type == SHT_IA_64_UNWIND)
          {
            unwsec = sec;
            break;
          }

+      /* We have already counted the number of SHT_IA64_UNWIND
+        sections so the loop above should never fail.  */
+      assert (unwsec != NULL);

 
       unwstart = i + 1;
       len = sizeof (ELF_STRING_ia64_unwind_once) - 1;
 
       unwstart = i + 1;
       len = sizeof (ELF_STRING_ia64_unwind_once) - 1;


@@ -6337,18 +6755,26 @@ ia64_process_unwind (FILE * file)
       if ((unwsec->sh_flags & SHF_GROUP) != 0)
        {
          /* We need to find which section group it is in.  */
       if ((unwsec->sh_flags & SHF_GROUP) != 0)
        {
          /* We need to find which section group it is in.  */

-         struct group_list * g = section_headers_groups [i]->root;
+         struct group_list * g;

 
 

-         for (; g != NULL; g = g->next)
+         if (section_headers_groups == NULL
+             || section_headers_groups [i] == NULL)
+           i = elf_header.e_shnum;
+         else

            {
            {

-             sec = section_headers + g->section_index;
+             g = section_headers_groups [i]->root;

 
 

-             if (streq (SECTION_NAME (sec), ELF_STRING_ia64_unwind_info))
-               break;
-           }
+             for (; g != NULL; g = g->next)
+               {
+                 sec = section_headers + g->section_index;

 
 

-         if (g == NULL)
-           i = elf_header.e_shnum;
+                 if (streq (SECTION_NAME (sec), ELF_STRING_ia64_unwind_info))
+                   break;
+               }
+
+             if (g == NULL)
+               i = elf_header.e_shnum;
+           }

        }
       else if (strneq (SECTION_NAME (unwsec), ELF_STRING_ia64_unwind_once, len))
        {
        }
       else if (strneq (SECTION_NAME (unwsec), ELF_STRING_ia64_unwind_once, len))
        {


@@ -6384,14 +6810,14 @@ ia64_process_unwind (FILE * file)
          if (string_table == NULL)
            printf ("%d", unwsec->sh_name);
          else
          if (string_table == NULL)
            printf ("%d", unwsec->sh_name);
          else

-           printf (_("'%s'"), SECTION_NAME (unwsec));
+           printf ("'%s'", printable_section_name (unwsec));

        }
       else
        {
          aux.info_addr = sec->sh_addr;
          aux.info = (unsigned char *) get_data (NULL, file, sec->sh_offset, 1,
        }
       else
        {
          aux.info_addr = sec->sh_addr;
          aux.info = (unsigned char *) get_data (NULL, file, sec->sh_offset, 1,

-                                                 sec->sh_size,
-                                                 _("unwind info"));
+                                                sec->sh_size,
+                                                _("unwind info"));

          aux.info_size = aux.info == NULL ? 0 : sec->sh_size;
 
          printf (_("\nUnwind section "));
          aux.info_size = aux.info == NULL ? 0 : sec->sh_size;
 
          printf (_("\nUnwind section "));


@@ -6399,15 +6825,14 @@ ia64_process_unwind (FILE * file)
          if (string_table == NULL)
            printf ("%d", unwsec->sh_name);
          else
          if (string_table == NULL)
            printf ("%d", unwsec->sh_name);
          else

-           printf (_("'%s'"), SECTION_NAME (unwsec));
+           printf ("'%s'", printable_section_name (unwsec));

 
          printf (_(" at offset 0x%lx contains %lu entries:\n"),
                  (unsigned long) unwsec->sh_offset,
                  (unsigned long) (unwsec->sh_size / (3 * eh_addr_size)));
 
 
          printf (_(" at offset 0x%lx contains %lu entries:\n"),
                  (unsigned long) unwsec->sh_offset,
                  (unsigned long) (unwsec->sh_size / (3 * eh_addr_size)));
 

-         (void) slurp_ia64_unwind_table (file, & aux, unwsec);
-
-         if (aux.table_len > 0)
+         if (slurp_ia64_unwind_table (file, & aux, unwsec)
+             && aux.table_len > 0)

            dump_ia64_unwind (& aux);
 
          if (aux.table)
            dump_ia64_unwind (& aux);
 
          if (aux.table)


@@ -6716,7 +7141,11 @@ hppa_process_unwind (FILE * file)
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;

-         assert (aux.strtab == NULL);
+         if (aux.strtab != NULL)
+           {
+             error (_("Multiple auxillary string tables encountered\n"));
+             free (aux.strtab);
+           }

          aux.strtab = (char *) get_data (NULL, file, strsec->sh_offset,
                                           1, strsec->sh_size,
                                           _("string table"));
          aux.strtab = (char *) get_data (NULL, file, strsec->sh_offset,
                                           1, strsec->sh_size,
                                           _("string table"));


@@ -6733,10 +7162,8 @@ hppa_process_unwind (FILE * file)
     {
       if (streq (SECTION_NAME (sec), ".PARISC.unwind"))
        {
     {
       if (streq (SECTION_NAME (sec), ".PARISC.unwind"))
        {

-         printf (_("\nUnwind section "));
-         printf (_("'%s'"), SECTION_NAME (sec));
-
-         printf (_(" at offset 0x%lx contains %lu entries:\n"),
+         printf (_("\nUnwind section '%s' at offset 0x%lx contains %lu entries:\n"),
+                 printable_section_name (sec),

                  (unsigned long) sec->sh_offset,
                  (unsigned long) (sec->sh_size / (2 * eh_addr_size + 8)));
 
                  (unsigned long) sec->sh_offset,
                  (unsigned long) (sec->sh_size / (2 * eh_addr_size + 8)));
 


@@ -6840,6 +7267,9 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
   unsigned int word;
   bfd_boolean wrapped;
 
   unsigned int word;
   bfd_boolean wrapped;
 

+  if (sec == NULL || arm_sec == NULL)
+    return FALSE;
+

   addr->section = SHN_UNDEF;
   addr->offset = 0;
 
   addr->section = SHN_UNDEF;
   addr->offset = 0;
 


@@ -6895,9 +7325,20 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
   if (arm_sec->data == NULL)
     return FALSE;
 
   if (arm_sec->data == NULL)
     return FALSE;
 

+  /* If the offset is invalid then fail.  */
+  if (word_offset > sec->sh_size - 4)
+    return FALSE;
+

   /* Get the word at the required offset.  */
   word = byte_get (arm_sec->data + word_offset, 4);
 
   /* Get the word at the required offset.  */
   word = byte_get (arm_sec->data + word_offset, 4);
 

+  /* PR 17531: file: id:000001,src:001266+003044,op:splice,rep:128.  */
+  if (arm_sec->rela == NULL)
+    {
+      * wordp = word;
+      return TRUE;
+    }
+

   /* Look through the relocs to find the one that applies to the provided offset.  */
   wrapped = FALSE;
   for (rp = arm_sec->next_rela; rp != arm_sec->rela + arm_sec->nrelas; rp++)
   /* Look through the relocs to find the one that applies to the provided offset.  */
   wrapped = FALSE;
   for (rp = arm_sec->next_rela; rp != arm_sec->rela + arm_sec->nrelas; rp++)


@@ -6922,7 +7363,9 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
       if (rp->r_offset < word_offset)
        continue;
 
       if (rp->r_offset < word_offset)
        continue;
 

-      sym = aux->symtab + ELF32_R_SYM (rp->r_info);
+      /* PR 17531: file: 027-161405-0.004  */
+      if (aux->symtab == NULL)
+       continue;

 
       if (arm_sec->rel_type == SHT_REL)
        {
 
       if (arm_sec->rel_type == SHT_REL)
        {


@@ -6933,8 +7376,21 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
       else if (arm_sec->rel_type == SHT_RELA)
        offset = rp->r_addend;
       else
       else if (arm_sec->rel_type == SHT_RELA)
        offset = rp->r_addend;
       else

-       abort ();
+       {
+         error (_("Unknown section relocation type %d encountered\n"),
+                arm_sec->rel_type);
+         break;
+       }

 
 

+      /* PR 17531 file: 027-1241568-0.004.  */
+      if (ELF32_R_SYM (rp->r_info) >= aux->nsyms)
+       {
+         error (_("Bad symbol index in unwind relocation (%lu > %lu)\n"),
+                (unsigned long) ELF32_R_SYM (rp->r_info), aux->nsyms);
+         break;
+       }
+
+      sym = aux->symtab + ELF32_R_SYM (rp->r_info);

       offset += sym->st_value;
       prelval = offset - (arm_sec->sec->sh_addr + rp->r_offset);
 
       offset += sym->st_value;
       prelval = offset - (arm_sec->sec->sh_addr + rp->r_offset);
 


@@ -6942,38 +7398,54 @@ get_unwind_section_word (struct arm_unw_aux_info *  aux,
       if (elf_header.e_machine == EM_ARM)
        {
          relname = elf_arm_reloc_type (ELF32_R_TYPE (rp->r_info));
       if (elf_header.e_machine == EM_ARM)
        {
          relname = elf_arm_reloc_type (ELF32_R_TYPE (rp->r_info));

+         if (relname == NULL)
+           {
+             warn (_("Skipping unknown ARM relocation type: %d\n"),
+                   (int) ELF32_R_TYPE (rp->r_info));
+             continue;
+           }

 
          if (streq (relname, "R_ARM_NONE"))
              continue;
 
          if (! streq (relname, "R_ARM_PREL31"))
            {
 
          if (streq (relname, "R_ARM_NONE"))
              continue;
 
          if (! streq (relname, "R_ARM_PREL31"))
            {

-             warn (_("Skipping unexpected relocation type %s\n"), relname);
+             warn (_("Skipping unexpected ARM relocation type %s\n"), relname);

              continue;
            }
        }
       else if (elf_header.e_machine == EM_TI_C6000)
        {
          relname = elf_tic6x_reloc_type (ELF32_R_TYPE (rp->r_info));
              continue;
            }
        }
       else if (elf_header.e_machine == EM_TI_C6000)
        {
          relname = elf_tic6x_reloc_type (ELF32_R_TYPE (rp->r_info));

+         if (relname == NULL)
+           {
+             warn (_("Skipping unknown C6000 relocation type: %d\n"),
+                   (int) ELF32_R_TYPE (rp->r_info));
+             continue;
+           }

 
          if (streq (relname, "R_C6000_NONE"))
            continue;
 
          if (! streq (relname, "R_C6000_PREL31"))
            {
 
          if (streq (relname, "R_C6000_NONE"))
            continue;
 
          if (! streq (relname, "R_C6000_PREL31"))
            {

-             warn (_("Skipping unexpected relocation type %s\n"), relname);
+             warn (_("Skipping unexpected C6000 relocation type %s\n"), relname);

              continue;
            }
 
          prelval >>= 1;
        }
       else
              continue;
            }
 
          prelval >>= 1;
        }
       else

-       /* This function currently only supports ARM and TI unwinders.  */
-       abort ();
+       {
+         /* This function currently only supports ARM and TI unwinders.  */
+         warn (_("Only TI and ARM unwinders are currently supported\n"));
+         break;
+       }

 
       word = (word & ~ (bfd_vma) 0x7fffffff) | (prelval & 0x7fffffff);
       addr->section = sym->st_shndx;
       addr->offset = offset;
 
       word = (word & ~ (bfd_vma) 0x7fffffff) | (prelval & 0x7fffffff);
       addr->section = sym->st_shndx;
       addr->offset = offset;

+

       if (sym_name)
        * sym_name = sym->st_name;
       break;
       if (sym_name)
        * sym_name = sym->st_name;
       break;


@@ -7161,11 +7633,15 @@ decode_arm_unwind_bytecode (struct arm_unw_aux_info *aux,
              if ((buf[i] & 0x80) == 0)
                break;
            }
              if ((buf[i] & 0x80) == 0)
                break;
            }

-         assert (i < sizeof (buf));
-         offset = read_uleb128 (buf, &len, buf + i + 1);
-         assert (len == i + 1);
-         offset = offset * 4 + 0x204;
-         printf ("vsp = vsp + %ld", offset);
+         if (i == sizeof (buf))
+           printf (_("corrupt change to vsp"));
+         else
+           {
+             offset = read_uleb128 (buf, &len, buf + i + 1);
+             assert (len == i + 1);
+             offset = offset * 4 + 0x204;
+             printf ("vsp = vsp + %ld", offset);
+           }

        }
       else if (op == 0xb3 || op == 0xc8 || op == 0xc9)
        {
        }
       else if (op == 0xb3 || op == 0xc8 || op == 0xc9)
        {


@@ -7357,7 +7833,14 @@ decode_tic6x_unwind_bytecode (struct arm_unw_aux_info *aux,
              if ((buf[i] & 0x80) == 0)
                break;
            }
              if ((buf[i] & 0x80) == 0)
                break;
            }

-         assert (i < sizeof (buf));
+         /* PR 17531: file: id:000001,src:001906+004739,op:splice,rep:2.  */
+         if (i == sizeof (buf))
+           {
+             printf ("<corrupt sp adjust>\n");
+             warn (_("Corrupt stack pointer adjustment detected\n"));
+             return;
+           }
+         

          offset = read_uleb128 (buf, &len, buf + i + 1);
          assert (len == i + 1);
          offset = offset * 8 + 0x408;
          offset = read_uleb128 (buf, &len, buf + i + 1);
          assert (len == i + 1);
          offset = offset * 8 + 0x408;


@@ -7540,7 +8023,7 @@ decode_arm_unwind (struct arm_unw_aux_info *  aux,
       break;
 
     default:
       break;
 
     default:

-      error (_("Unsupported architecture type %d encountered when decoding unwind table"),
+      error (_("Unsupported architecture type %d encountered when decoding unwind table\n"),

             elf_header.e_machine);
     }
 
             elf_header.e_machine);
     }
 


@@ -7660,7 +8143,7 @@ arm_process_unwind (FILE *file)
       break;
 
     default:
       break;
 
     default:

-      error (_("Unsupported architecture type %d encountered when processing unwind table"),
+      error (_("Unsupported architecture type %d encountered when processing unwind table\n"),

             elf_header.e_machine);
       return;
     }
             elf_header.e_machine);
       return;
     }


@@ -7678,7 +8161,13 @@ arm_process_unwind (FILE *file)
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;
          aux.symtab = GET_ELF_SYMBOLS (file, sec, & aux.nsyms);
 
          strsec = section_headers + sec->sh_link;

-         assert (aux.strtab == NULL);
+
+         /* PR binutils/17531 file: 011-12666-0.004.  */
+         if (aux.strtab != NULL)
+           {
+             error (_("Multiple string tables found in file.\n"));
+             free (aux.strtab);
+           }

          aux.strtab = get_data (NULL, file, strsec->sh_offset,
                                 1, strsec->sh_size, _("string table"));
          aux.strtab_size = aux.strtab != NULL ? strsec->sh_size : 0;
          aux.strtab = get_data (NULL, file, strsec->sh_offset,
                                 1, strsec->sh_size, _("string table"));
          aux.strtab_size = aux.strtab != NULL ? strsec->sh_size : 0;


@@ -7695,7 +8184,7 @@ arm_process_unwind (FILE *file)
        if (sec->sh_type == sec_type)
          {
            printf (_("\nUnwind table index '%s' at offset 0x%lx contains %lu entries:\n"),
        if (sec->sh_type == sec_type)
          {
            printf (_("\nUnwind table index '%s' at offset 0x%lx contains %lu entries:\n"),

-                   SECTION_NAME (sec),
+                   printable_section_name (sec),

                    (unsigned long) sec->sh_offset,
                    (unsigned long) (sec->sh_size / (2 * eh_addr_size)));
 
                    (unsigned long) sec->sh_offset,
                    (unsigned long) (sec->sh_size / (2 * eh_addr_size)));
 


@@ -7774,19 +8263,28 @@ dynamic_section_mips_val (Elf_Internal_Dyn * entry)
       if (VALID_DYNAMIC_NAME (entry->d_un.d_val))
        printf (_("Interface Version: %s"), GET_DYNAMIC_NAME (entry->d_un.d_val));
       else
       if (VALID_DYNAMIC_NAME (entry->d_un.d_val))
        printf (_("Interface Version: %s"), GET_DYNAMIC_NAME (entry->d_un.d_val));
       else

-       printf (_("<corrupt: %" BFD_VMA_FMT "d>"), entry->d_un.d_ptr);
+       {
+         char buf[40];
+         sprintf_vma (buf, entry->d_un.d_ptr);
+         /* Note: coded this way so that there is a single string for translation.  */
+         printf (_("<corrupt: %s>"), buf);
+       }

       break;
 
     case DT_MIPS_TIME_STAMP:
       {
        char timebuf[20];
        struct tm * tmp;
       break;
 
     case DT_MIPS_TIME_STAMP:
       {
        char timebuf[20];
        struct tm * tmp;

-

        time_t atime = entry->d_un.d_val;
        time_t atime = entry->d_un.d_val;

+

        tmp = gmtime (&atime);
        tmp = gmtime (&atime);

-       snprintf (timebuf, sizeof (timebuf), "%04u-%02u-%02uT%02u:%02u:%02u",
-                 tmp->tm_year + 1900, tmp->tm_mon + 1, tmp->tm_mday,
-                 tmp->tm_hour, tmp->tm_min, tmp->tm_sec);
+       /* PR 17531: file: 6accc532.  */
+       if (tmp == NULL)
+         snprintf (timebuf, sizeof (timebuf), _("<corrupt>"));
+       else
+         snprintf (timebuf, sizeof (timebuf), "%04u-%02u-%02uT%02u:%02u:%02u",
+                   tmp->tm_year + 1900, tmp->tm_mon + 1, tmp->tm_mday,
+                   tmp->tm_hour, tmp->tm_min, tmp->tm_sec);

        printf (_("Time Stamp: %s"), timebuf);
       }
       break;
        printf (_("Time Stamp: %s"), timebuf);
       }
       break;


@@ -7969,11 +8467,11 @@ get_32bit_dynamic_section (FILE * file)
   if (!edyn)
     return 0;
 
   if (!edyn)
     return 0;
 

-/* SGI's ELF has more than one section in the DYNAMIC segment, and we
-   might not have the luxury of section headers.  Look for the DT_NULL
-   terminator to determine the number of entries.  */
+  /* SGI's ELF has more than one section in the DYNAMIC segment, and we
+     might not have the luxury of section headers.  Look for the DT_NULL
+     terminator to determine the number of entries.  */

   for (ext = edyn, dynamic_nent = 0;
   for (ext = edyn, dynamic_nent = 0;

-       (char *) ext < (char *) edyn + dynamic_size;
+       (char *) ext < (char *) edyn + dynamic_size - sizeof (* entry);

        ext++)
     {
       dynamic_nent++;
        ext++)
     {
       dynamic_nent++;


@@ -7985,7 +8483,8 @@ get_32bit_dynamic_section (FILE * file)
                                                   sizeof (* entry));
   if (dynamic_section == NULL)
     {
                                                   sizeof (* entry));
   if (dynamic_section == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory allocating space for %lu dynamic entries\n"),
+            (unsigned long) dynamic_nent);

       free (edyn);
       return 0;
     }
       free (edyn);
       return 0;
     }


@@ -8010,16 +8509,18 @@ get_64bit_dynamic_section (FILE * file)
   Elf64_External_Dyn * ext;
   Elf_Internal_Dyn * entry;
 
   Elf64_External_Dyn * ext;
   Elf_Internal_Dyn * entry;
 

+  /* Read in the data.  */

   edyn = (Elf64_External_Dyn *) get_data (NULL, file, dynamic_addr, 1,
                                           dynamic_size, _("dynamic section"));
   if (!edyn)
     return 0;
 
   edyn = (Elf64_External_Dyn *) get_data (NULL, file, dynamic_addr, 1,
                                           dynamic_size, _("dynamic section"));
   if (!edyn)
     return 0;
 

-/* SGI's ELF has more than one section in the DYNAMIC segment, and we
-   might not have the luxury of section headers.  Look for the DT_NULL
-   terminator to determine the number of entries.  */
+  /* SGI's ELF has more than one section in the DYNAMIC segment, and we
+     might not have the luxury of section headers.  Look for the DT_NULL
+     terminator to determine the number of entries.  */

   for (ext = edyn, dynamic_nent = 0;
   for (ext = edyn, dynamic_nent = 0;

-       (char *) ext < (char *) edyn + dynamic_size;
+       /* PR 17533 file: 033-67080-0.004 - do not read off the end of the buffer.  */
+       (char *) ext < ((char *) edyn) + dynamic_size - sizeof (* ext);

        ext++)
     {
       dynamic_nent++;
        ext++)
     {
       dynamic_nent++;


@@ -8031,11 +8532,13 @@ get_64bit_dynamic_section (FILE * file)
                                                   sizeof (* entry));
   if (dynamic_section == NULL)
     {
                                                   sizeof (* entry));
   if (dynamic_section == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory allocating space for %lu dynamic entries\n"),
+            (unsigned long) dynamic_nent);

       free (edyn);
       return 0;
     }
 
       free (edyn);
       return 0;
     }
 

+  /* Convert from external to internal formats.  */

   for (ext = edyn, entry = dynamic_section;
        entry < dynamic_section + dynamic_nent;
        ext++, entry++)
   for (ext = edyn, entry = dynamic_section;
        entry < dynamic_section + dynamic_nent;
        ext++, entry++)


@@ -8136,6 +8639,7 @@ process_dynamic_section (FILE * file)
            section.sh_entsize = sizeof (Elf32_External_Sym);
          else
            section.sh_entsize = sizeof (Elf64_External_Sym);
            section.sh_entsize = sizeof (Elf32_External_Sym);
          else
            section.sh_entsize = sizeof (Elf64_External_Sym);

+         section.sh_name = string_table_length;

 
          dynamic_symbols = GET_ELF_SYMBOLS (file, &section, & num_dynamic_syms);
          if (num_dynamic_syms < 1)
 
          dynamic_symbols = GET_ELF_SYMBOLS (file, &section, & num_dynamic_syms);
          if (num_dynamic_syms < 1)


@@ -8205,7 +8709,11 @@ process_dynamic_section (FILE * file)
            {
              /* Note: these braces are necessary to avoid a syntax
                 error from the SunOS4 C compiler.  */
            {
              /* Note: these braces are necessary to avoid a syntax
                 error from the SunOS4 C compiler.  */

-             assert (sizeof (Elf_External_Syminfo) == entry->d_un.d_val);
+             /* PR binutils/17531: A corrupt file can trigger this test.
+                So do not use an assert, instead generate an error message.  */
+             if (sizeof (Elf_External_Syminfo) != entry->d_un.d_val)
+               error (_("Bad value (%d) for SYMINENT entry\n"),
+                      (int) entry->d_un.d_val);

            }
          else if (entry->d_tag == DT_SYMINSZ)
            syminsz = entry->d_un.d_val;
            }
          else if (entry->d_tag == DT_SYMINSZ)
            syminsz = entry->d_un.d_val;


@@ -8230,7 +8738,8 @@ process_dynamic_section (FILE * file)
          dynamic_syminfo = (Elf_Internal_Syminfo *) malloc (syminsz);
          if (dynamic_syminfo == NULL)
            {
          dynamic_syminfo = (Elf_Internal_Syminfo *) malloc (syminsz);
          if (dynamic_syminfo == NULL)
            {

-             error (_("Out of memory\n"));
+             error (_("Out of memory allocating %lu byte for dynamic symbol info\n"),
+                    (unsigned long) syminsz);

              return 0;
            }
 
              return 0;
            }
 


@@ -8248,8 +8757,8 @@ process_dynamic_section (FILE * file)
     }
 
   if (do_dynamic && dynamic_addr)
     }
 
   if (do_dynamic && dynamic_addr)

-    printf (_("\nDynamic section at offset 0x%lx contains %u entries:\n"),
-           dynamic_addr, dynamic_nent);
+    printf (_("\nDynamic section at offset 0x%lx contains %lu entries:\n"),
+           dynamic_addr, (unsigned long) dynamic_nent);

   if (do_dynamic)
     printf (_("  Tag        Type                         Name/Value\n"));
 
   if (do_dynamic)
     printf (_("  Tag        Type                         Name/Value\n"));
 


@@ -8661,9 +9170,14 @@ process_dynamic_section (FILE * file)
              time_t atime = entry->d_un.d_val;
 
              tmp = gmtime (&atime);
              time_t atime = entry->d_un.d_val;
 
              tmp = gmtime (&atime);

-             printf ("%04u-%02u-%02uT%02u:%02u:%02u\n",
-                     tmp->tm_year + 1900, tmp->tm_mon + 1, tmp->tm_mday,
-                     tmp->tm_hour, tmp->tm_min, tmp->tm_sec);
+             /* PR 17533 file: 041-1244816-0.004.  */
+             if (tmp == NULL)
+               printf (_("<corrupt time val: %lx"),
+                       (unsigned long) atime);
+             else
+               printf ("%04u-%02u-%02uT%02u:%02u:%02u\n",
+                       tmp->tm_year + 1900, tmp->tm_mon + 1, tmp->tm_mday,
+                       tmp->tm_hour, tmp->tm_min, tmp->tm_sec);

 
            }
          break;
 
            }
          break;


@@ -8770,17 +9284,15 @@ process_version_sections (FILE * file)
 
            found = 1;
 
 
            found = 1;
 

-           printf
-             (_("\nVersion definition section '%s' contains %u entries:\n"),
-              SECTION_NAME (section), section->sh_info);
+           printf (_("\nVersion definition section '%s' contains %u entries:\n"),
+                   printable_section_name (section),
+                   section->sh_info);

 
            printf (_("  Addr: 0x"));
            printf_vma (section->sh_addr);
 
            printf (_("  Addr: 0x"));
            printf_vma (section->sh_addr);

-           printf (_("  Offset: %#08lx  Link: %u (%s)\n"),
+           printf (_("  Offset: %#08lx  Link: %u (%s)"),

                    (unsigned long) section->sh_offset, section->sh_link,
                    (unsigned long) section->sh_offset, section->sh_link,

-                   section->sh_link < elf_header.e_shnum
-                   ? SECTION_NAME (section_headers + section->sh_link)
-                   : _("<corrupt>"));
+                   printable_section_name_from_index (section->sh_link));

 
            edefs = (Elf_External_Verdef *)
                 get_data (NULL, file, section->sh_offset, 1,section->sh_size,
 
            edefs = (Elf_External_Verdef *)
                 get_data (NULL, file, section->sh_offset, 1,section->sh_size,


@@ -8868,6 +9380,10 @@ process_version_sections (FILE * file)
                if (j < ent.vd_cnt)
                  printf (_("  Version def aux past end of section\n"));
 
                if (j < ent.vd_cnt)
                  printf (_("  Version def aux past end of section\n"));
 

+               /* PR 17531: file: id:000001,src:000172+005151,op:splice,rep:2.  */
+               if (idx + ent.vd_next <= idx)
+                 break;
+

                idx += ent.vd_next;
              }
 
                idx += ent.vd_next;
              }
 


@@ -8888,15 +9404,13 @@ process_version_sections (FILE * file)
            found = 1;
 
            printf (_("\nVersion needs section '%s' contains %u entries:\n"),
            found = 1;
 
            printf (_("\nVersion needs section '%s' contains %u entries:\n"),

-                   SECTION_NAME (section), section->sh_info);
+                   printable_section_name (section), section->sh_info);

 
            printf (_(" Addr: 0x"));
            printf_vma (section->sh_addr);
            printf (_("  Offset: %#08lx  Link: %u (%s)\n"),
                    (unsigned long) section->sh_offset, section->sh_link,
 
            printf (_(" Addr: 0x"));
            printf_vma (section->sh_addr);
            printf (_("  Offset: %#08lx  Link: %u (%s)\n"),
                    (unsigned long) section->sh_offset, section->sh_link,

-                   section->sh_link < elf_header.e_shnum
-                   ? SECTION_NAME (section_headers + section->sh_link)
-                   : _("<corrupt>"));
+                   printable_section_name_from_index (section->sh_link));

 
            eneed = (Elf_External_Verneed *) get_data (NULL, file,
                                                        section->sh_offset, 1,
 
            eneed = (Elf_External_Verneed *) get_data (NULL, file,
                                                        section->sh_offset, 1,


@@ -8941,7 +9455,6 @@ process_version_sections (FILE * file)
                /* Check for overflow.  */
                if (ent.vn_aux > (size_t) (endbuf - vstart))
                  break;
                /* Check for overflow.  */
                if (ent.vn_aux > (size_t) (endbuf - vstart))
                  break;

-

                vstart += ent.vn_aux;
 
                for (j = 0, isum = idx + ent.vn_aux; j < ent.vn_cnt; ++j)
                vstart += ent.vn_aux;
 
                for (j = 0, isum = idx + ent.vn_aux; j < ent.vn_cnt; ++j)


@@ -8970,9 +9483,14 @@ process_version_sections (FILE * file)
                            get_ver_flags (aux.vna_flags), aux.vna_other);
 
                    /* Check for overflow.  */
                            get_ver_flags (aux.vna_flags), aux.vna_other);
 
                    /* Check for overflow.  */

-                   if (aux.vna_next > (size_t) (endbuf - vstart))
-                     break;
-
+                   if (aux.vna_next > (size_t) (endbuf - vstart)
+                       || (aux.vna_next == 0 && j < ent.vn_cnt - 1))
+                     {
+                       warn (_("Invalid vna_next field of %lx\n"),
+                             aux.vna_next);
+                       j = ent.vn_cnt;
+                       break;
+                     }

                    isum   += aux.vna_next;
                    vstart += aux.vna_next;
                  }
                    isum   += aux.vna_next;
                    vstart += aux.vna_next;
                  }


@@ -8999,8 +9517,8 @@ process_version_sections (FILE * file)
        case SHT_GNU_versym:
          {
            Elf_Internal_Shdr * link_section;
        case SHT_GNU_versym:
          {
            Elf_Internal_Shdr * link_section;

-           int total;
-           int cnt;
+           size_t total;
+           unsigned int cnt;

            unsigned char * edata;
            unsigned short * data;
            char * strtab;
            unsigned char * edata;
            unsigned short * data;
            char * strtab;


@@ -9035,14 +9553,14 @@ process_version_sections (FILE * file)
                break;
              }
 
                break;
              }
 

-           printf (_("\nVersion symbols section '%s' contains %d entries:\n"),
-                   SECTION_NAME (section), total);
+           printf (_("\nVersion symbols section '%s' contains %lu entries:\n"),
+                   printable_section_name (section), (unsigned long) total);

 
            printf (_(" Addr: "));
            printf_vma (section->sh_addr);
            printf (_("  Offset: %#08lx  Link: %u (%s)\n"),
                    (unsigned long) section->sh_offset, section->sh_link,
 
            printf (_(" Addr: "));
            printf_vma (section->sh_addr);
            printf (_("  Offset: %#08lx  Link: %u (%s)\n"),
                    (unsigned long) section->sh_offset, section->sh_link,

-                   SECTION_NAME (link_section));
+                   printable_section_name (link_section));

 
            off = offset_from_vma (file,
                                   version_info[DT_VERSIONTAGIDX (DT_VERSYM)],
 
            off = offset_from_vma (file,
                                   version_info[DT_VERSIONTAGIDX (DT_VERSYM)],


@@ -9191,7 +9709,9 @@ process_version_sections (FILE * file)
                                            _("version def")) == NULL)
                                {
                                  ivd.vd_next = 0;
                                            _("version def")) == NULL)
                                {
                                  ivd.vd_next = 0;

-                                 ivd.vd_ndx  = 0;
+                                 /* PR 17531: file: 046-1082287-0.004.  */ 
+                                 ivd.vd_ndx  = (data[cnt + j] & VERSYM_VERSION) + 1;
+                                 break;

                                }
                              else
                                {
                                }
                              else
                                {


@@ -9347,7 +9867,9 @@ get_symbol_visibility (unsigned int visibility)
     case STV_INTERNAL: return "INTERNAL";
     case STV_HIDDEN:   return "HIDDEN";
     case STV_PROTECTED: return "PROTECTED";
     case STV_INTERNAL: return "INTERNAL";
     case STV_HIDDEN:   return "HIDDEN";
     case STV_PROTECTED: return "PROTECTED";

-    default: abort ();
+    default:
+      error (_("Unrecognized visibility value: %u"), visibility);
+      return _("<unknown>");

     }
 }
 
     }
 }
 


@@ -9402,7 +9924,10 @@ get_ia64_symbol_other (unsigned int other)
               strcat (res, " RSV");
               break;
             default:
               strcat (res, " RSV");
               break;
             default:

-              abort ();
+             warn (_("Unrecognized IA64 VMS ST Function type: %d\n"),
+                   VMS_ST_FUNC_TYPE (other));
+             strcat (res, " <unknown>");
+             break;

             }
           break;
         default:
             }
           break;
         default:


@@ -9423,7 +9948,10 @@ get_ia64_symbol_other (unsigned int other)
           strcat (res, " LNK");
           break;
         default:
           strcat (res, " LNK");
           break;
         default:

-          abort ();
+         warn (_("Unrecognized IA64 VMS ST Linkage: %d\n"),
+               VMS_ST_LINKAGE (other));
+         strcat (res, " <unknown>");
+         break;

         }
 
       if (res[0] != 0)
         }
 
       if (res[0] != 0)


@@ -9513,7 +10041,7 @@ get_symbol_index_type (unsigned int type)
       else if (type >= SHN_LORESERVE)
        sprintf (buff, "RSV[0x%04x]", type & 0xffff);
       else if (type >= elf_header.e_shnum)
       else if (type >= SHN_LORESERVE)
        sprintf (buff, "RSV[0x%04x]", type & 0xffff);
       else if (type >= elf_header.e_shnum)

-       sprintf (buff, "bad section index[%3d]", type);
+       sprintf (buff, _("bad section index[%3d]"), type);

       else
        sprintf (buff, "%3d", type);
       break;
       else
        sprintf (buff, "%3d", type);
       break;


@@ -9523,30 +10051,41 @@ get_symbol_index_type (unsigned int type)
 }
 
 static bfd_vma *
 }
 
 static bfd_vma *

-get_dynamic_data (FILE * file, unsigned int number, unsigned int ent_size)
+get_dynamic_data (FILE * file, size_t number, unsigned int ent_size)

 {
   unsigned char * e_data;
   bfd_vma * i_data;
 
 {
   unsigned char * e_data;
   bfd_vma * i_data;
 

-  e_data = (unsigned char *) cmalloc (number, ent_size);
+  /* Be kind to memory chekers (eg valgrind, address sanitizer) by not
+     attempting to allocate memory when the read is bound to fail.  */
+  if (ent_size * number > current_file_size)
+    {
+      error (_("Invalid number of dynamic entries: %lu\n"),
+            (unsigned long) number);
+      return NULL;
+    }

 
 

+  e_data = (unsigned char *) cmalloc (number, ent_size);

   if (e_data == NULL)
     {
   if (e_data == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory reading %lu dynamic entries\n"),
+            (unsigned long) number);

       return NULL;
     }
 
   if (fread (e_data, ent_size, number, file) != number)
     {
       return NULL;
     }
 
   if (fread (e_data, ent_size, number, file) != number)
     {

-      error (_("Unable to read in dynamic data\n"));
+      error (_("Unable to read in %lu bytes of dynamic data\n"),
+            (unsigned long) (number * ent_size));
+      free (e_data);

       return NULL;
     }
 
   i_data = (bfd_vma *) cmalloc (number, sizeof (*i_data));
       return NULL;
     }
 
   i_data = (bfd_vma *) cmalloc (number, sizeof (*i_data));

-

   if (i_data == NULL)
     {
   if (i_data == NULL)
     {

-      error (_("Out of memory\n"));
+      error (_("Out of memory allocating space for %lu dynamic entries\n"),
+            (unsigned long) number);

       free (e_data);
       return NULL;
     }
       free (e_data);
       return NULL;
     }


@@ -9565,12 +10104,19 @@ print_dynamic_symbol (bfd_vma si, unsigned long hn)
   Elf_Internal_Sym * psym;
   int n;
 
   Elf_Internal_Sym * psym;
   int n;
 

-  psym = dynamic_symbols + si;
-

   n = print_vma (si, DEC_5);
   if (n < 5)
     fputs (&"     "[n], stdout);
   printf (" %3lu: ", hn);
   n = print_vma (si, DEC_5);
   if (n < 5)
     fputs (&"     "[n], stdout);
   printf (" %3lu: ", hn);

+
+  if (dynamic_symbols == NULL || si >= num_dynamic_syms)
+    {
+      printf (_("<No info available for dynamic symbol number %lu>\n"),
+             (unsigned long) si);
+      return;
+    }
+
+  psym = dynamic_symbols + si;

   print_vma (psym->st_value, LONG_HEX);
   putchar (' ');
   print_vma (psym->st_size, DEC_5);
   print_vma (psym->st_value, LONG_HEX);
   putchar (' ');
   print_vma (psym->st_size, DEC_5);


@@ -9592,19 +10138,196 @@ print_dynamic_symbol (bfd_vma si, unsigned long hn)
   putchar ('\n');
 }
 
   putchar ('\n');
 }
 

+static const char *
+get_symbol_version_string (FILE *file, int is_dynsym,
+                          const char *strtab,
+                          unsigned long int strtab_size,
+                          unsigned int si, Elf_Internal_Sym *psym,
+                          enum versioned_symbol_info *sym_info,
+                          unsigned short *vna_other)
+{
+  const char *version_string = NULL;
+
+  if (is_dynsym
+      && version_info[DT_VERSIONTAGIDX (DT_VERSYM)] != 0)
+    {
+      unsigned char data[2];
+      unsigned short vers_data;
+      unsigned long offset;
+      int is_nobits;
+      int check_def;
+
+      offset = offset_from_vma
+       (file, version_info[DT_VERSIONTAGIDX (DT_VERSYM)],
+        sizeof data + si * sizeof (vers_data));
+
+      if (get_data (&data, file, offset + si * sizeof (vers_data),
+                   sizeof (data), 1, _("version data")) == NULL)
+       return NULL;
+
+      vers_data = byte_get (data, 2);
+
+      is_nobits = (section_headers != NULL
+                  && psym->st_shndx < elf_header.e_shnum
+                  && section_headers[psym->st_shndx].sh_type
+                  == SHT_NOBITS);
+
+      check_def = (psym->st_shndx != SHN_UNDEF);
+
+      if ((vers_data & VERSYM_HIDDEN) || vers_data > 1)
+       {
+         if (version_info[DT_VERSIONTAGIDX (DT_VERNEED)]
+             && (is_nobits || ! check_def))
+           {
+             Elf_External_Verneed evn;
+             Elf_Internal_Verneed ivn;
+             Elf_Internal_Vernaux ivna;
+
+             /* We must test both.  */
+             offset = offset_from_vma
+               (file, version_info[DT_VERSIONTAGIDX (DT_VERNEED)],
+                sizeof evn);
+
+             do
+               {
+                 unsigned long vna_off;
+
+                 if (get_data (&evn, file, offset, sizeof (evn), 1,
+                               _("version need")) == NULL)
+                   {
+                     ivna.vna_next = 0;
+                     ivna.vna_other = 0;
+                     ivna.vna_name = 0;
+                     break;
+                   }
+
+                 ivn.vn_aux  = BYTE_GET (evn.vn_aux);
+                 ivn.vn_next = BYTE_GET (evn.vn_next);
+
+                 vna_off = offset + ivn.vn_aux;
+
+                 do
+                   {
+                     Elf_External_Vernaux evna;
+
+                     if (get_data (&evna, file, vna_off,
+                                   sizeof (evna), 1,
+                                   _("version need aux (3)")) == NULL)
+                       {
+                         ivna.vna_next = 0;
+                         ivna.vna_other = 0;
+                         ivna.vna_name = 0;
+                       }
+                     else
+                       {
+                         ivna.vna_other = BYTE_GET (evna.vna_other);
+                         ivna.vna_next  = BYTE_GET (evna.vna_next);
+                         ivna.vna_name  = BYTE_GET (evna.vna_name);
+                       }
+
+                     vna_off += ivna.vna_next;
+                   }
+                 while (ivna.vna_other != vers_data
+                        && ivna.vna_next != 0);
+
+                 if (ivna.vna_other == vers_data)
+                   break;
+
+                 offset += ivn.vn_next;
+               }
+             while (ivn.vn_next != 0);
+
+             if (ivna.vna_other == vers_data)
+               {
+                 *sym_info = symbol_undefined;
+                 *vna_other = ivna.vna_other;
+                 version_string = (ivna.vna_name < strtab_size
+                                   ? strtab + ivna.vna_name
+                                   : _("<corrupt>"));
+                 check_def = 0;
+               }
+             else if (! is_nobits)
+               error (_("bad dynamic symbol\n"));
+             else
+               check_def = 1;
+           }
+
+         if (check_def)
+           {
+             if (vers_data != 0x8001
+                 && version_info[DT_VERSIONTAGIDX (DT_VERDEF)])
+               {
+                 Elf_Internal_Verdef ivd;
+                 Elf_Internal_Verdaux ivda;
+                 Elf_External_Verdaux evda;
+                 unsigned long off;
+
+                 off = offset_from_vma
+                   (file,
+                    version_info[DT_VERSIONTAGIDX (DT_VERDEF)],
+                    sizeof (Elf_External_Verdef));
+
+                 do
+                   {
+                     Elf_External_Verdef evd;
+
+                     if (get_data (&evd, file, off, sizeof (evd),
+                                   1, _("version def")) == NULL)
+                       {
+                         ivd.vd_ndx = 0;
+                         ivd.vd_aux = 0;
+                         ivd.vd_next = 0;
+                       }
+                     else
+                       {
+                         ivd.vd_ndx = BYTE_GET (evd.vd_ndx);
+                         ivd.vd_aux = BYTE_GET (evd.vd_aux);
+                         ivd.vd_next = BYTE_GET (evd.vd_next);
+                       }
+
+                     off += ivd.vd_next;
+                   }
+                 while (ivd.vd_ndx != (vers_data & VERSYM_VERSION)
+                        && ivd.vd_next != 0);
+
+                 off -= ivd.vd_next;
+                 off += ivd.vd_aux;
+
+                 if (get_data (&evda, file, off, sizeof (evda),
+                               1, _("version def aux")) == NULL)
+                   return version_string;
+
+                 ivda.vda_name = BYTE_GET (evda.vda_name);
+
+                 if (psym->st_name != ivda.vda_name)
+                   {
+                     *sym_info = ((vers_data & VERSYM_HIDDEN) != 0
+                                  ? symbol_hidden : symbol_public);
+                     version_string = (ivda.vda_name < strtab_size
+                                       ? strtab + ivda.vda_name
+                                       : _("<corrupt>"));
+                   }
+               }
+           }
+       }
+    }
+  return version_string;
+}
+

 /* Dump the symbol table.  */
 static int
 process_symbol_table (FILE * file)
 {
   Elf_Internal_Shdr * section;
 /* Dump the symbol table.  */
 static int
 process_symbol_table (FILE * file)
 {
   Elf_Internal_Shdr * section;

-  bfd_vma nbuckets = 0;
-  bfd_vma nchains = 0;
+  bfd_size_type nbuckets = 0;
+  bfd_size_type nchains = 0;

   bfd_vma * buckets = NULL;
   bfd_vma * chains = NULL;
   bfd_vma ngnubuckets = 0;
   bfd_vma * gnubuckets = NULL;
   bfd_vma * gnuchains = NULL;
   bfd_vma gnusymidx = 0;
   bfd_vma * buckets = NULL;
   bfd_vma * chains = NULL;
   bfd_vma ngnubuckets = 0;
   bfd_vma * gnubuckets = NULL;
   bfd_vma * gnuchains = NULL;
   bfd_vma gnusymidx = 0;

+  bfd_size_type ngnuchains = 0;

 
   if (!do_syms && !do_dyn_syms && !do_histogram)
     return 1;
 
   if (!do_syms && !do_dyn_syms && !do_histogram)
     return 1;


@@ -9617,7 +10340,7 @@ process_symbol_table (FILE * file)
     {
       unsigned char nb[8];
       unsigned char nc[8];
     {
       unsigned char nb[8];
       unsigned char nc[8];

-      int hash_ent_size = 4;
+      unsigned int hash_ent_size = 4;

 
       if ((elf_header.e_machine == EM_ALPHA
           || elf_header.e_machine == EM_S390
 
       if ((elf_header.e_machine == EM_ALPHA
           || elf_header.e_machine == EM_S390


@@ -9766,6 +10489,7 @@ process_symbol_table (FILE * file)
        }
 
       gnuchains = get_dynamic_data (file, maxchain, 4);
        }
 
       gnuchains = get_dynamic_data (file, maxchain, 4);

+      ngnuchains = maxchain;

 
     no_gnu_hash:
       if (gnuchains == NULL)
 
     no_gnu_hash:
       if (gnuchains == NULL)


@@ -9781,7 +10505,8 @@ process_symbol_table (FILE * file)
   if ((dynamic_info[DT_HASH] || dynamic_info_DT_GNU_HASH)
       && do_syms
       && do_using_dynamic
   if ((dynamic_info[DT_HASH] || dynamic_info_DT_GNU_HASH)
       && do_syms
       && do_using_dynamic

-      && dynamic_strings != NULL)
+      && dynamic_strings != NULL
+      && dynamic_symbols != NULL)

     {
       unsigned long hn;
 
     {
       unsigned long hn;
 


@@ -9824,11 +10549,12 @@ process_symbol_table (FILE * file)
                    print_dynamic_symbol (si, hn);
                    si++;
                  }
                    print_dynamic_symbol (si, hn);
                    si++;
                  }

-               while ((gnuchains[off++] & 1) == 0);
+               while (off < ngnuchains && (gnuchains[off++] & 1) == 0);

              }
        }
     }
              }
        }
     }

-  else if (do_dyn_syms || (do_syms && !do_using_dynamic))
+  else if ((do_dyn_syms || (do_syms && !do_using_dynamic))
+          && section_headers != NULL)

     {
       unsigned int i;
 
     {
       unsigned int i;
 


@@ -9852,12 +10578,12 @@ process_symbol_table (FILE * file)
          if (section->sh_entsize == 0)
            {
              printf (_("\nSymbol table '%s' has a sh_entsize of zero!\n"),
          if (section->sh_entsize == 0)
            {
              printf (_("\nSymbol table '%s' has a sh_entsize of zero!\n"),

-                     SECTION_NAME (section));
+                     printable_section_name (section));

              continue;
            }
 
          printf (_("\nSymbol table '%s' contains %lu entries:\n"),
              continue;
            }
 
          printf (_("\nSymbol table '%s' contains %lu entries:\n"),

-                 SECTION_NAME (section),
+                 printable_section_name (section),

                  (unsigned long) (section->sh_size / section->sh_entsize));
 
          if (is_32bit_elf)
                  (unsigned long) (section->sh_size / section->sh_entsize));
 
          if (is_32bit_elf)


@@ -9888,6 +10614,10 @@ process_symbol_table (FILE * file)
 
          for (si = 0, psym = symtab; si < num_syms; si++, psym++)
            {
 
          for (si = 0, psym = symtab; si < num_syms; si++, psym++)
            {

+             const char *version_string;
+             enum versioned_symbol_info sym_info;
+             unsigned short vna_other;
+

              printf ("%6d: ", si);
              print_vma (psym->st_value, LONG_HEX);
              putchar (' ');
              printf ("%6d: ", si);
              print_vma (psym->st_value, LONG_HEX);
              putchar (' ');


@@ -9904,163 +10634,18 @@ process_symbol_table (FILE * file)
              print_symbol (25, psym->st_name < strtab_size
                            ? strtab + psym->st_name : _("<corrupt>"));
 
              print_symbol (25, psym->st_name < strtab_size
                            ? strtab + psym->st_name : _("<corrupt>"));
 

-             if (section->sh_type == SHT_DYNSYM
-                 && version_info[DT_VERSIONTAGIDX (DT_VERSYM)] != 0)
+             version_string
+               = get_symbol_version_string (file,
+                                            section->sh_type == SHT_DYNSYM,
+                                            strtab, strtab_size, si,
+                                            psym, &sym_info, &vna_other);
+             if (version_string)

                {
                {

-                 unsigned char data[2];
-                 unsigned short vers_data;
-                 unsigned long offset;
-                 int is_nobits;
-                 int check_def;
-
-                 offset = offset_from_vma
-                   (file, version_info[DT_VERSIONTAGIDX (DT_VERSYM)],
-                    sizeof data + si * sizeof (vers_data));
-
-                 if (get_data (&data, file, offset + si * sizeof (vers_data),
-                               sizeof (data), 1, _("version data")) == NULL)
-                   break;
-
-                 vers_data = byte_get (data, 2);
-
-                 is_nobits = (psym->st_shndx < elf_header.e_shnum
-                              && section_headers[psym->st_shndx].sh_type
-                                 == SHT_NOBITS);
-
-                 check_def = (psym->st_shndx != SHN_UNDEF);
-
-                 if ((vers_data & VERSYM_HIDDEN) || vers_data > 1)
-                   {
-                     if (version_info[DT_VERSIONTAGIDX (DT_VERNEED)]
-                         && (is_nobits || ! check_def))
-                       {
-                         Elf_External_Verneed evn;
-                         Elf_Internal_Verneed ivn;
-                         Elf_Internal_Vernaux ivna;
-
-                         /* We must test both.  */
-                         offset = offset_from_vma
-                           (file, version_info[DT_VERSIONTAGIDX (DT_VERNEED)],
-                            sizeof evn);
-
-                         do
-                           {
-                             unsigned long vna_off;
-
-                             if (get_data (&evn, file, offset, sizeof (evn), 1,
-                                           _("version need")) == NULL)
-                               {
-                                 ivna.vna_next = 0;
-                                 ivna.vna_other = 0;
-                                 ivna.vna_name = 0;
-                                 break;
-                               }
-
-                             ivn.vn_aux  = BYTE_GET (evn.vn_aux);
-                             ivn.vn_next = BYTE_GET (evn.vn_next);
-
-                             vna_off = offset + ivn.vn_aux;
-
-                             do
-                               {
-                                 Elf_External_Vernaux evna;
-
-                                 if (get_data (&evna, file, vna_off,
-                                               sizeof (evna), 1,
-                                               _("version need aux (3)")) == NULL)
-                                   {
-                                     ivna.vna_next = 0;
-                                     ivna.vna_other = 0;
-                                     ivna.vna_name = 0;
-                                   }
-                                 else
-                                   {
-                                     ivna.vna_other = BYTE_GET (evna.vna_other);
-                                     ivna.vna_next  = BYTE_GET (evna.vna_next);
-                                     ivna.vna_name  = BYTE_GET (evna.vna_name);
-                                   }
-
-                                 vna_off += ivna.vna_next;
-                               }
-                             while (ivna.vna_other != vers_data
-                                    && ivna.vna_next != 0);
-
-                             if (ivna.vna_other == vers_data)
-                               break;
-
-                             offset += ivn.vn_next;
-                           }
-                         while (ivn.vn_next != 0);
-
-                         if (ivna.vna_other == vers_data)
-                           {
-                             printf ("@%s (%d)",
-                                     ivna.vna_name < strtab_size
-                                     ? strtab + ivna.vna_name : _("<corrupt>"),
-                                     ivna.vna_other);
-                             check_def = 0;
-                           }
-                         else if (! is_nobits)
-                           error (_("bad dynamic symbol\n"));
-                         else
-                           check_def = 1;
-                       }
-
-                     if (check_def)
-                       {
-                         if (vers_data != 0x8001
-                             && version_info[DT_VERSIONTAGIDX (DT_VERDEF)])
-                           {
-                             Elf_Internal_Verdef ivd;
-                             Elf_Internal_Verdaux ivda;
-                             Elf_External_Verdaux evda;
-                             unsigned long off;
-
-                             off = offset_from_vma
-                               (file,
-                                version_info[DT_VERSIONTAGIDX (DT_VERDEF)],
-                                sizeof (Elf_External_Verdef));
-
-                             do
-                               {
-                                 Elf_External_Verdef evd;
-
-                                 if (get_data (&evd, file, off, sizeof (evd),
-                                               1, _("version def")) == NULL)
-                                   {
-                                     ivd.vd_ndx = 0;
-                                     ivd.vd_aux = 0;
-                                     ivd.vd_next = 0;
-                                   }
-                                 else
-                                   {
-                                     ivd.vd_ndx = BYTE_GET (evd.vd_ndx);
-                                     ivd.vd_aux = BYTE_GET (evd.vd_aux);
-                                     ivd.vd_next = BYTE_GET (evd.vd_next);
-                                   }
-
-                                 off += ivd.vd_next;
-                               }
-                             while (ivd.vd_ndx != (vers_data & VERSYM_VERSION)
-                                    && ivd.vd_next != 0);
-
-                             off -= ivd.vd_next;
-                             off += ivd.vd_aux;
-
-                             if (get_data (&evda, file, off, sizeof (evda),
-                                           1, _("version def aux")) == NULL)
-                               break;
-
-                             ivda.vda_name = BYTE_GET (evda.vda_name);
-
-                             if (psym->st_name != ivda.vda_name)
-                               printf ((vers_data & VERSYM_HIDDEN)
-                                       ? "@%s" : "@@%s",
-                                       ivda.vda_name < strtab_size
-                                       ? strtab + ivda.vda_name : _("<corrupt>"));
-                           }
-                       }
-                   }
+                 if (sym_info == symbol_undefined)
+                   printf ("@%s (%d)", version_string, vna_other);
+                 else
+                   printf (sym_info == symbol_hidden ? "@%s" : "@@%s",
+                           version_string);

                }
 
              putchar ('\n');
                }
 
              putchar ('\n');


@@ -10087,14 +10672,15 @@ process_symbol_table (FILE * file)
 
       printf (_("\nHistogram for bucket list length (total of %lu buckets):\n"),
              (unsigned long) nbuckets);
 
       printf (_("\nHistogram for bucket list length (total of %lu buckets):\n"),
              (unsigned long) nbuckets);

-      printf (_(" Length  Number     %% of total  Coverage\n"));

 
       lengths = (unsigned long *) calloc (nbuckets, sizeof (*lengths));
       if (lengths == NULL)
        {
 
       lengths = (unsigned long *) calloc (nbuckets, sizeof (*lengths));
       if (lengths == NULL)
        {

-         error (_("Out of memory\n"));
+         error (_("Out of memory allocating space for histogram buckets\n"));

          return 0;
        }
          return 0;
        }

+
+      printf (_(" Length  Number     %% of total  Coverage\n"));

       for (hn = 0; hn < nbuckets; ++hn)
        {
          for (si = buckets[hn]; si > 0 && si < nchains; si = chains[si])
       for (hn = 0; hn < nbuckets; ++hn)
        {
          for (si = buckets[hn]; si > 0 && si < nchains; si = chains[si])


@@ -10102,6 +10688,15 @@ process_symbol_table (FILE * file)
              ++nsyms;
              if (maxlength < ++lengths[hn])
                ++maxlength;
              ++nsyms;
              if (maxlength < ++lengths[hn])
                ++maxlength;

+
+             /* PR binutils/17531: A corrupt binary could contain broken
+                histogram data.  Do not go into an infinite loop trying
+                to process it.  */
+             if (chains[si] == si)
+               {
+                 error (_("histogram chain links to itself\n"));
+                 break;
+               }

            }
        }
 
            }
        }
 


@@ -10109,7 +10704,7 @@ process_symbol_table (FILE * file)
       if (counts == NULL)
        {
          free (lengths);
       if (counts == NULL)
        {
          free (lengths);

-         error (_("Out of memory\n"));
+         error (_("Out of memory allocating space for histogram counts\n"));

          return 0;
        }
 
          return 0;
        }
 


@@ -10149,15 +10744,16 @@ process_symbol_table (FILE * file)
       unsigned long nzero_counts = 0;
       unsigned long nsyms = 0;
 
       unsigned long nzero_counts = 0;
       unsigned long nsyms = 0;
 

+      printf (_("\nHistogram for `.gnu.hash' bucket list length (total of %lu buckets):\n"),
+             (unsigned long) ngnubuckets);
+

       lengths = (unsigned long *) calloc (ngnubuckets, sizeof (*lengths));
       if (lengths == NULL)
        {
       lengths = (unsigned long *) calloc (ngnubuckets, sizeof (*lengths));
       if (lengths == NULL)
        {

-         error (_("Out of memory\n"));
+         error (_("Out of memory allocating space for gnu histogram buckets\n"));

          return 0;
        }
 
          return 0;
        }
 

-      printf (_("\nHistogram for `.gnu.hash' bucket list length (total of %lu buckets):\n"),
-             (unsigned long) ngnubuckets);

       printf (_(" Length  Number     %% of total  Coverage\n"));
 
       for (hn = 0; hn < ngnubuckets; ++hn)
       printf (_(" Length  Number     %% of total  Coverage\n"));
 
       for (hn = 0; hn < ngnubuckets; ++hn)


@@ -10166,7 +10762,9 @@ process_symbol_table (FILE * file)
            bfd_vma off, length = 1;
 
            for (off = gnubuckets[hn] - gnusymidx;
            bfd_vma off, length = 1;
 
            for (off = gnubuckets[hn] - gnusymidx;

-                (gnuchains[off] & 1) == 0; ++off)
+                /* PR 17531 file: 010-77222-0.004.  */
+                off < ngnuchains && (gnuchains[off] & 1) == 0;
+                ++off)

              ++length;
            lengths[hn] = length;
            if (length > maxlength)
              ++length;
            lengths[hn] = length;
            if (length > maxlength)


@@ -10178,7 +10776,7 @@ process_symbol_table (FILE * file)
       if (counts == NULL)
        {
          free (lengths);
       if (counts == NULL)
        {
          free (lengths);

-         error (_("Out of memory\n"));
+         error (_("Out of memory allocating space for gnu histogram counts\n"));

          return 0;
        }
 
          return 0;
        }
 


@@ -10232,7 +10830,9 @@ process_syminfo (FILE * file ATTRIBUTE_UNUSED)
       unsigned short int flags = dynamic_syminfo[i].si_flags;
 
       printf ("%4d: ", i);
       unsigned short int flags = dynamic_syminfo[i].si_flags;
 
       printf ("%4d: ", i);

-      if (VALID_DYNAMIC_NAME (dynamic_symbols[i].st_name))
+      if (i >= num_dynamic_syms)
+       printf (_("<corrupt index>"));
+      else if (VALID_DYNAMIC_NAME (dynamic_symbols[i].st_name))

        print_symbol (30, GET_DYNAMIC_NAME (dynamic_symbols[i].st_name));
       else
        printf (_("<corrupt: %19ld>"), dynamic_symbols[i].st_name);
        print_symbol (30, GET_DYNAMIC_NAME (dynamic_symbols[i].st_name));
       else
        printf (_("<corrupt: %19ld>"), dynamic_symbols[i].st_name);


@@ -10335,7 +10935,7 @@ target_specific_reloc_handling (Elf_Internal_Rela * reloc,
 
          default:
            if (saved_sym != NULL)
 
          default:
            if (saved_sym != NULL)

-             error (_("Unhandled MSP430 reloc type found after SYM_DIFF reloc"));
+             error (_("Unhandled MSP430 reloc type found after SYM_DIFF reloc\n"));

            break;
          }
        break;
            break;
          }
        break;


@@ -10371,7 +10971,7 @@ target_specific_reloc_handling (Elf_Internal_Rela * reloc,
            break;
          default:
            if (saved_sym != NULL)
            break;
          default:
            if (saved_sym != NULL)

-             error (_("Unhandled MN10300 reloc type found after SYM_DIFF reloc"));
+             error (_("Unhandled MN10300 reloc type found after SYM_DIFF reloc\n"));

            break;
          }
        break;
            break;
          }
        break;


@@ -10440,6 +11040,8 @@ is_32bit_abs_reloc (unsigned int reloc_type)
     case EM_CYGNUS_FR30:
     case EM_FR30:
       return reloc_type == 3; /* R_FR30_32.  */
     case EM_CYGNUS_FR30:
     case EM_FR30:
       return reloc_type == 3; /* R_FR30_32.  */

+    case EM_FT32:
+      return reloc_type == 1; /* R_FT32_32.  */

     case EM_H8S:
     case EM_H8_300:
     case EM_H8_300H:
     case EM_H8S:
     case EM_H8_300:
     case EM_H8_300H:


@@ -10534,6 +11136,8 @@ is_32bit_abs_reloc (unsigned int reloc_type)
       return reloc_type == 0x33; /* R_V810_WORD.  */
     case EM_VAX:
       return reloc_type == 1; /* R_VAX_32.  */
       return reloc_type == 0x33; /* R_V810_WORD.  */
     case EM_VAX:
       return reloc_type == 1; /* R_VAX_32.  */

+    case EM_VISIUM:
+      return reloc_type == 3;  /* R_VISIUM_32. */

     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:
     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:


@@ -10549,9 +11153,16 @@ is_32bit_abs_reloc (unsigned int reloc_type)
     case EM_XTENSA:
       return reloc_type == 1; /* R_XTENSA_32.  */
     default:
     case EM_XTENSA:
       return reloc_type == 1; /* R_XTENSA_32.  */
     default:

-      error (_("Missing knowledge of 32-bit reloc types used in DWARF sections of machine number %d\n"),
-            elf_header.e_machine);
-      abort ();
+      {
+       static unsigned int prev_warn = 0;
+
+       /* Avoid repeating the same warning multiple times.  */
+       if (prev_warn != elf_header.e_machine)
+         error (_("Missing knowledge of 32-bit reloc types used in DWARF sections of machine number %d\n"),
+                elf_header.e_machine);
+       prev_warn = elf_header.e_machine;
+       return FALSE;
+      }

     }
 }
 
     }
 }
 


@@ -10601,6 +11212,8 @@ is_32bit_pcrel_reloc (unsigned int reloc_type)
       return reloc_type == 6; /* R_TILEGX_32_PCREL.  */
     case EM_TILEPRO:
       return reloc_type == 4; /* R_TILEPRO_32_PCREL.  */
       return reloc_type == 6; /* R_TILEGX_32_PCREL.  */
     case EM_TILEPRO:
       return reloc_type == 4; /* R_TILEPRO_32_PCREL.  */

+    case EM_VISIUM:
+      return reloc_type == 6;  /* R_VISIUM_32_PCREL */

     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:
     case EM_X86_64:
     case EM_L1OM:
     case EM_K1OM:


@@ -10758,6 +11371,8 @@ is_16bit_abs_reloc (unsigned int reloc_type)
     case EM_CYGNUS_MN10300:
     case EM_MN10300:
       return reloc_type == 2; /* R_MN10300_16.  */
     case EM_CYGNUS_MN10300:
     case EM_MN10300:
       return reloc_type == 2; /* R_MN10300_16.  */

+    case EM_VISIUM:
+      return reloc_type == 2; /* R_VISIUM_16. */

     case EM_XGATE:
       return reloc_type == 3; /* R_XGATE_16.  */
     default:
     case EM_XGATE:
       return reloc_type == 3; /* R_XGATE_16.  */
     default:


@@ -10794,6 +11409,7 @@ is_none_reloc (unsigned int reloc_type)
     case EM_L1OM:    /* R_X86_64_NONE.  */
     case EM_K1OM:    /* R_X86_64_NONE.  */
     case EM_MN10300: /* R_MN10300_NONE.  */
     case EM_L1OM:    /* R_X86_64_NONE.  */
     case EM_K1OM:    /* R_X86_64_NONE.  */
     case EM_MN10300: /* R_MN10300_NONE.  */

+    case EM_FT32:    /* R_FT32_NONE.  */

     case EM_MOXIE:   /* R_MOXIE_NONE.  */
     case EM_M32R:    /* R_M32R_NONE.  */
     case EM_TI_C6000:/* R_C6000_NONE.  */
     case EM_MOXIE:   /* R_MOXIE_NONE.  */
     case EM_M32R:    /* R_M32R_NONE.  */
     case EM_TI_C6000:/* R_C6000_NONE.  */


@@ -10910,8 +11526,11 @@ apply_relocations (void * file,
            reloc_size = 2;
          else
            {
            reloc_size = 2;
          else
            {

-             warn (_("unable to apply unsupported reloc type %d to section %s\n"),
-                   reloc_type, SECTION_NAME (section));
+             static unsigned int prev_reloc = 0;
+             if (reloc_type != prev_reloc)
+               warn (_("unable to apply unsupported reloc type %d to section %s\n"),
+                     reloc_type, printable_section_name (section));
+             prev_reloc = reloc_type;

              continue;
            }
 
              continue;
            }
 


@@ -10920,7 +11539,7 @@ apply_relocations (void * file,
            {
              warn (_("skipping invalid relocation offset 0x%lx in section %s\n"),
                    (unsigned long) rp->r_offset,
            {
              warn (_("skipping invalid relocation offset 0x%lx in section %s\n"),
                    (unsigned long) rp->r_offset,

-                   SECTION_NAME (section));
+                   printable_section_name (section));

              continue;
            }
 
              continue;
            }
 


@@ -10928,7 +11547,7 @@ apply_relocations (void * file,
          if (sym_index >= num_syms)
            {
              warn (_("skipping invalid relocation symbol index 0x%lx in section %s\n"),
          if (sym_index >= num_syms)
            {
              warn (_("skipping invalid relocation symbol index 0x%lx in section %s\n"),

-                   sym_index, SECTION_NAME (section));
+                   sym_index, printable_section_name (section));

              continue;
            }
          sym = symtab + sym_index;
              continue;
            }
          sym = symtab + sym_index;


@@ -10952,7 +11571,7 @@ apply_relocations (void * file,
              warn (_("skipping unexpected symbol type %s in %ld'th relocation in section %s\n"),
                    get_symbol_type (ELF_ST_TYPE (sym->st_info)),
                    (long int)(rp - relocs),
              warn (_("skipping unexpected symbol type %s in %ld'th relocation in section %s\n"),
                    get_symbol_type (ELF_ST_TYPE (sym->st_info)),
                    (long int)(rp - relocs),

-                   SECTION_NAME (relsec));
+                   printable_section_name (relsec));

              continue;
            }
 
              continue;
            }
 


@@ -10995,10 +11614,9 @@ apply_relocations (void * file,
 static int
 disassemble_section (Elf_Internal_Shdr * section, FILE * file)
 {
 static int
 disassemble_section (Elf_Internal_Shdr * section, FILE * file)
 {

-  printf (_("\nAssembly dump of section %s\n"),
-         SECTION_NAME (section));
+  printf (_("\nAssembly dump of section %s\n"), printable_section_name (section));

 
 

-  /* XXX -- to be done --- XXX */
+  /* FIXME: XXX -- to be done --- XXX */

 
   return 1;
 }
 
   return 1;
 }


@@ -11017,7 +11635,7 @@ get_section_contents (Elf_Internal_Shdr * section, FILE * file)
   if (num_bytes == 0 || section->sh_type == SHT_NOBITS)
     {
       printf (_("\nSection '%s' has no data to dump.\n"),
   if (num_bytes == 0 || section->sh_type == SHT_NOBITS)
     {
       printf (_("\nSection '%s' has no data to dump.\n"),

-             SECTION_NAME (section));
+             printable_section_name (section));

       return NULL;
     }
 
       return NULL;
     }
 


@@ -11034,14 +11652,13 @@ dump_section_as_strings (Elf_Internal_Shdr * section, FILE * file)
   char * data;
   char * end;
   char * start;
   char * data;
   char * end;
   char * start;

-  char * name = SECTION_NAME (section);

   bfd_boolean some_strings_shown;
 
   start = get_section_contents (section, file);
   if (start == NULL)
     return;
 
   bfd_boolean some_strings_shown;
 
   start = get_section_contents (section, file);
   if (start == NULL)
     return;
 

-  printf (_("\nString dump of section '%s':\n"), name);
+  printf (_("\nString dump of section '%s':\n"), printable_section_name (section));

 
   /* If the section being dumped has relocations against it the user might
      be expecting these relocations to have been applied.  Check for this
 
   /* If the section being dumped has relocations against it the user might
      be expecting these relocations to have been applied.  Check for this


@@ -11076,15 +11693,26 @@ dump_section_as_strings (Elf_Internal_Shdr * section, FILE * file)
 
       if (data < end)
        {
 
       if (data < end)
        {

+         size_t maxlen = end - data;
+

 #ifndef __MSVCRT__
          /* PR 11128: Use two separate invocations in order to work
              around bugs in the Solaris 8 implementation of printf.  */
          printf ("  [%6tx]  ", data - start);
 #ifndef __MSVCRT__
          /* PR 11128: Use two separate invocations in order to work
              around bugs in the Solaris 8 implementation of printf.  */
          printf ("  [%6tx]  ", data - start);

-         printf ("%s\n", data);

 #else
 #else

-         printf ("  [%6Ix]  %s\n", (size_t) (data - start), data);
+         printf ("  [%6Ix]  ", (size_t) (data - start));

 #endif
 #endif

-         data += strlen (data);
+         if (maxlen > 0)
+           {
+             print_symbol ((int) maxlen, data);
+             putchar ('\n');
+             data += strnlen (data, maxlen);
+           }
+         else
+           {
+             printf (_("<corrupt>\n"));
+             data = end;
+           }

          some_strings_shown = TRUE;
        }
     }
          some_strings_shown = TRUE;
        }
     }


@@ -11112,7 +11740,7 @@ dump_section_as_bytes (Elf_Internal_Shdr * section,
   if (start == NULL)
     return;
 
   if (start == NULL)
     return;
 

-  printf (_("\nHex dump of section '%s':\n"), SECTION_NAME (section));
+  printf (_("\nHex dump of section '%s':\n"), printable_section_name (section));

 
   if (relocate)
     {
 
   if (relocate)
     {


@@ -11272,6 +11900,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
 
   snprintf (buf, sizeof (buf), _("%s section data"), section->name);
   section->address = sec->sh_addr;
 
   snprintf (buf, sizeof (buf), _("%s section data"), section->name);
   section->address = sec->sh_addr;

+  section->user_data = NULL;

   section->start = (unsigned char *) get_data (NULL, (FILE *) file,
                                                sec->sh_offset, 1,
                                                sec->sh_size, buf);
   section->start = (unsigned char *) get_data (NULL, (FILE *) file,
                                                sec->sh_offset, 1,
                                                sec->sh_size, buf);


@@ -11343,6 +11972,7 @@ static int
 display_debug_section (int shndx, Elf_Internal_Shdr * section, FILE * file)
 {
   char * name = SECTION_NAME (section);
 display_debug_section (int shndx, Elf_Internal_Shdr * section, FILE * file)
 {
   char * name = SECTION_NAME (section);

+  const char * print_name = printable_section_name (section);

   bfd_size_type length;
   int result = 1;
   int i;
   bfd_size_type length;
   int result = 1;
   int i;


@@ -11350,7 +11980,7 @@ display_debug_section (int shndx, Elf_Internal_Shdr * section, FILE * file)
   length = section->sh_size;
   if (length == 0)
     {
   length = section->sh_size;
   if (length == 0)
     {

-      printf (_("\nSection '%s' has no debugging data.\n"), name);
+      printf (_("\nSection '%s' has no debugging data.\n"), print_name);

       return 0;
     }
   if (section->sh_type == SHT_NOBITS)
       return 0;
     }
   if (section->sh_type == SHT_NOBITS)


@@ -11359,7 +11989,8 @@ display_debug_section (int shndx, Elf_Internal_Shdr * section, FILE * file)
         which has the NOBITS type - the bits in the file will be random.
         This can happen when a file containing a .eh_frame section is
         stripped with the --only-keep-debug command line option.  */
         which has the NOBITS type - the bits in the file will be random.
         This can happen when a file containing a .eh_frame section is
         stripped with the --only-keep-debug command line option.  */

-      printf (_("section '%s' has the NOBITS type - its contents are unreliable.\n"), name);
+      printf (_("section '%s' has the NOBITS type - its contents are unreliable.\n"),
+             print_name);

       return 0;
     }
 
       return 0;
     }
 


@@ -11404,7 +12035,7 @@ display_debug_section (int shndx, Elf_Internal_Shdr * section, FILE * file)
 
   if (i == max)
     {
 
   if (i == max)
     {

-      printf (_("Unrecognized debug section: %s\n"), name);
+      printf (_("Unrecognized debug section: %s\n"), print_name);

       result = 0;
     }
 
       result = 0;
     }
 


@@ -11523,13 +12154,25 @@ display_tag_value (int tag,
 
   if (p >= end)
     {
 
   if (p >= end)
     {

-      warn (_("corrupt tag\n"));
+      warn (_("<corrupt tag>\n"));

     }
   else if (tag & 1)
     {
     }
   else if (tag & 1)
     {

-      /* FIXME: we could read beyond END here.  */
-      printf ("\"%s\"\n", p);
-      p += strlen ((char *) p) + 1;
+      /* PR 17531 file: 027-19978-0.004.  */
+      size_t maxlen = (end - p) - 1;
+
+      putchar ('"');
+      if (maxlen > 0)
+       {
+         print_symbol ((int) maxlen, (const char *) p);
+         p += strnlen ((char *) p, maxlen) + 1;
+       }
+      else
+       {
+         printf (_("<corrupt string tag>"));
+         p = (unsigned char *) end;
+       }
+      printf ("\"\n");

     }
   else
     {
     }
   else
     {


@@ -11540,16 +12183,17 @@ display_tag_value (int tag,
       printf ("%ld (0x%lx)\n", val, val);
     }
 
       printf ("%ld (0x%lx)\n", val, val);
     }
 

+  assert (p <= end);

   return p;
 }
 
 /* ARM EABI attributes section.  */
 typedef struct
 {
   return p;
 }
 
 /* ARM EABI attributes section.  */
 typedef struct
 {

-  int tag;
+  unsigned int tag;

   const char * name;
   /* 0 = special, 1 = string, 2 = uleb123, > 0x80 == table lookup.  */
   const char * name;
   /* 0 = special, 1 = string, 2 = uleb123, > 0x80 == table lookup.  */

-  int type;
+  unsigned int type;

   const char ** table;
 } arm_attr_public_tag;
 
   const char ** table;
 } arm_attr_public_tag;
 


@@ -11561,7 +12205,7 @@ static const char * arm_attr_tag_THUMB_ISA_use[] =
   {"No", "Thumb-1", "Thumb-2"};
 static const char * arm_attr_tag_FP_arch[] =
   {"No", "VFPv1", "VFPv2", "VFPv3", "VFPv3-D16", "VFPv4", "VFPv4-D16",
   {"No", "Thumb-1", "Thumb-2"};
 static const char * arm_attr_tag_FP_arch[] =
   {"No", "VFPv1", "VFPv2", "VFPv3", "VFPv3-D16", "VFPv4", "VFPv4-D16",

-   "FP for ARMv8"};
+   "FP for ARMv8", "FPv5/FP-D16 for ARMv8"};

 static const char * arm_attr_tag_WMMX_arch[] = {"No", "WMMXv1", "WMMXv2"};
 static const char * arm_attr_tag_Advanced_SIMD_arch[] =
   {"No", "NEONv1", "NEONv1 with Fused-MAC", "NEON for ARMv8"};
 static const char * arm_attr_tag_WMMX_arch[] = {"No", "WMMXv1", "WMMXv2"};
 static const char * arm_attr_tag_Advanced_SIMD_arch[] =
   {"No", "NEONv1", "NEONv1 with Fused-MAC", "NEON for ARMv8"};


@@ -11590,7 +12234,7 @@ static const char * arm_attr_tag_ABI_enum_size[] =
 static const char * arm_attr_tag_ABI_HardFP_use[] =
   {"As Tag_FP_arch", "SP only", "DP only", "SP and DP"};
 static const char * arm_attr_tag_ABI_VFP_args[] =
 static const char * arm_attr_tag_ABI_HardFP_use[] =
   {"As Tag_FP_arch", "SP only", "DP only", "SP and DP"};
 static const char * arm_attr_tag_ABI_VFP_args[] =

-  {"AAPCS", "VFP registers", "custom"};
+  {"AAPCS", "VFP registers", "custom", "compatible"};

 static const char * arm_attr_tag_ABI_WMMX_args[] =
   {"AAPCS", "WMMX registers", "custom"};
 static const char * arm_attr_tag_ABI_optimization_goals[] =
 static const char * arm_attr_tag_ABI_WMMX_args[] =
   {"AAPCS", "WMMX registers", "custom"};
 static const char * arm_attr_tag_ABI_optimization_goals[] =


@@ -11667,12 +12311,12 @@ static unsigned char *
 display_arm_attribute (unsigned char * p,
                       const unsigned char * const end)
 {
 display_arm_attribute (unsigned char * p,
                       const unsigned char * const end)
 {

-  int tag;
+  unsigned int tag;

   unsigned int len;
   unsigned int len;

-  int val;
+  unsigned int val;

   arm_attr_public_tag * attr;
   unsigned i;
   arm_attr_public_tag * attr;
   unsigned i;

-  int type;
+  unsigned int type;

 
   tag = read_uleb128 (p, &len, end);
   p += len;
 
   tag = read_uleb128 (p, &len, end);
   p += len;


@@ -11747,14 +12391,30 @@ display_arm_attribute (unsigned char * p,
              break;
 
            case 32: /* Tag_compatibility.  */
              break;
 
            case 32: /* Tag_compatibility.  */

-             val = read_uleb128 (p, &len, end);
-             p += len;
-             printf (_("flag = %d, vendor = %s\n"), val, p);
-             p += strlen ((char *) p) + 1;
+             {
+               val = read_uleb128 (p, &len, end);
+               p += len;
+               printf (_("flag = %d, vendor = "), val);
+               if (p < end - 1)
+                 {
+                   size_t maxlen = (end - p) - 1;
+
+                   print_symbol ((int) maxlen, (const char *) p);
+                   p += strnlen ((char *) p, maxlen) + 1;
+                 }
+               else
+                 {
+                   printf (_("<corrupt>"));
+                   p = (unsigned char *) end;
+                 }
+               putchar ('\n');
+             }

              break;
 
            case 64: /* Tag_nodefaults.  */
              break;
 
            case 64: /* Tag_nodefaults.  */

-             p++;
+             /* PR 17531: file: 001-505008-0.01.  */
+             if (p < end)
+               p++;

              printf (_("True\n"));
              break;
 
              printf (_("True\n"));
              break;
 


@@ -11765,18 +12425,20 @@ display_arm_attribute (unsigned char * p,
                {
                  val = read_uleb128 (p, &len, end);
                  p += len;
                {
                  val = read_uleb128 (p, &len, end);
                  p += len;

-                 if ((unsigned int)val >= ARRAY_SIZE (arm_attr_tag_CPU_arch))
+                 if ((unsigned int) val >= ARRAY_SIZE (arm_attr_tag_CPU_arch))

                    printf ("??? (%d)\n", val);
                  else
                    printf ("%s\n", arm_attr_tag_CPU_arch[val]);
                }
              else
                printf ("???\n");
                    printf ("??? (%d)\n", val);
                  else
                    printf ("%s\n", arm_attr_tag_CPU_arch[val]);
                }
              else
                printf ("???\n");

-             while (*(p++) != '\0' /* NUL terminator.  */);
+             while (p < end && *(p++) != '\0' /* NUL terminator.  */)
+               ;

              break;
 
            default:
              break;
 
            default:

-             abort ();
+             printf (_("<unknown: %d>\n"), tag);
+             break;

            }
          return p;
 
            }
          return p;
 


@@ -11819,15 +12481,28 @@ display_gnu_attribute (unsigned char * p,
     {
       val = read_uleb128 (p, &len, end);
       p += len;
     {
       val = read_uleb128 (p, &len, end);
       p += len;

+
+      printf (_("flag = %d, vendor = "), val);

       if (p == end)
        {
       if (p == end)
        {

-         printf (_("flag = %d, vendor = <corrupt>\n"), val);
+         printf (_("<corrupt>\n"));

          warn (_("corrupt vendor attribute\n"));
        }
       else
        {
          warn (_("corrupt vendor attribute\n"));
        }
       else
        {

-         printf (_("flag = %d, vendor = %s\n"), val, p);
-         p += strlen ((char *) p) + 1;
+         if (p < end - 1)
+           {
+             size_t maxlen = (end - p) - 1;
+
+             print_symbol ((int) maxlen, (const char *) p);
+             p += strnlen ((char *) p, maxlen) + 1;
+           }
+         else
+           {
+             printf (_("<corrupt>"));
+             p = (unsigned char *) end;
+           }
+         putchar ('\n');

        }
       return p;
     }
        }
       return p;
     }


@@ -11903,7 +12578,7 @@ display_power_gnu_attribute (unsigned char * p,
     {
       if (p == end)
        {
     {
       if (p == end)
        {

-         warn (_("corrupt Tag_GNU_Power_ABI_Struct_Return"));
+         warn (_("corrupt Tag_GNU_Power_ABI_Struct_Return\n"));

          return p;
        }
 
          return p;
        }
 


@@ -11937,6 +12612,7 @@ display_sparc_hwcaps (int mask)
   if (mask)
     {
       int first = 1;
   if (mask)
     {
       int first = 1;

+

       if (mask & ELF_SPARC_HWCAP_MUL32)
        fputs ("mul32", stdout), first = 0;
       if (mask & ELF_SPARC_HWCAP_DIV32)
       if (mask & ELF_SPARC_HWCAP_MUL32)
        fputs ("mul32", stdout), first = 0;
       if (mask & ELF_SPARC_HWCAP_DIV32)


@@ -11971,8 +12647,43 @@ display_sparc_hwcaps (int mask)
        printf ("%scspare", first ? "" : "|"), first = 0;
     }
   else
        printf ("%scspare", first ? "" : "|"), first = 0;
     }
   else

-    fputc('0', stdout);
-  fputc('\n', stdout);
+    fputc ('0', stdout);
+  fputc ('\n', stdout);
+}
+
+static void
+display_sparc_hwcaps2 (int mask)
+{
+  if (mask)
+    {
+      int first = 1;
+
+      if (mask & ELF_SPARC_HWCAP2_FJATHPLUS)
+       fputs ("fjathplus", stdout), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_VIS3B)
+       printf ("%svis3b", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_ADP)
+       printf ("%sadp", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_SPARC5)
+       printf ("%ssparc5", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_MWAIT)
+       printf ("%smwait", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_XMPMUL)
+       printf ("%sxmpmul", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_XMONT)
+       printf ("%sxmont2", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_NSEC)
+       printf ("%snsec", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_FJATHHPC)
+       printf ("%sfjathhpc", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_FJDES)
+       printf ("%sfjdes", first ? "" : "|"), first = 0;
+      if (mask & ELF_SPARC_HWCAP2_FJAES)
+       printf ("%sfjaes", first ? "" : "|"), first = 0;
+    }
+  else
+    fputc ('0', stdout);
+  fputc ('\n', stdout);

 }
 
 static unsigned char *
 }
 
 static unsigned char *


@@ -11980,17 +12691,25 @@ display_sparc_gnu_attribute (unsigned char * p,
                             int tag,
                             const unsigned char * const end)
 {
                             int tag,
                             const unsigned char * const end)
 {

+  unsigned int len;
+  int val;
+

   if (tag == Tag_GNU_Sparc_HWCAPS)
     {
   if (tag == Tag_GNU_Sparc_HWCAPS)
     {

-      unsigned int len;
-      int val;
-

       val = read_uleb128 (p, &len, end);
       p += len;
       printf ("  Tag_GNU_Sparc_HWCAPS: ");
       display_sparc_hwcaps (val);
       return p;
       val = read_uleb128 (p, &len, end);
       p += len;
       printf ("  Tag_GNU_Sparc_HWCAPS: ");
       display_sparc_hwcaps (val);
       return p;

-   }
+    }
+  if (tag == Tag_GNU_Sparc_HWCAPS2)
+    {
+      val = read_uleb128 (p, &len, end);
+      p += len;
+      printf ("  Tag_GNU_Sparc_HWCAPS2: ");
+      display_sparc_hwcaps2 (val);
+      return p;
+    }

 
   return display_tag_value (tag, p, end);
 }
 
   return display_tag_value (tag, p, end);
 }


@@ -12280,18 +12999,45 @@ display_tic6x_attribute (unsigned char * p,
       return p;
 
     case Tag_ABI_compatibility:
       return p;
 
     case Tag_ABI_compatibility:

-      val = read_uleb128 (p, &len, end);
-      p += len;
-      printf ("  Tag_ABI_compatibility: ");
-      printf (_("flag = %d, vendor = %s\n"), val, p);
-      p += strlen ((char *) p) + 1;
-      return p;
+      {
+       val = read_uleb128 (p, &len, end);
+       p += len;
+       printf ("  Tag_ABI_compatibility: ");
+       printf (_("flag = %d, vendor = "), val);
+       if (p < end - 1)
+         {
+           size_t maxlen = (end - p) - 1;
+
+           print_symbol ((int) maxlen, (const char *) p);
+           p += strnlen ((char *) p, maxlen) + 1;
+         }
+       else
+         {
+           printf (_("<corrupt>"));
+           p = (unsigned char *) end;
+         }
+       putchar ('\n');
+       return p;
+      }

 
     case Tag_ABI_conformance:
 
     case Tag_ABI_conformance:

-      printf ("  Tag_ABI_conformance: ");
-      printf ("\"%s\"\n", p);
-      p += strlen ((char *) p) + 1;
-      return p;
+      {
+       printf ("  Tag_ABI_conformance: \"");
+       if (p < end - 1)
+         {
+           size_t maxlen = (end - p) - 1;
+
+           print_symbol ((int) maxlen, (const char *) p);
+           p += strnlen ((char *) p, maxlen) + 1;
+         }
+       else
+         {
+           printf (_("<corrupt>"));
+           p = (unsigned char *) end;
+         }
+       printf ("\"\n");
+       return p;
+      }

     }
 
   return display_tag_value (tag, p, end);
     }
 
   return display_tag_value (tag, p, end);


@@ -12303,6 +13049,7 @@ display_raw_attribute (unsigned char * p, unsigned char * end)
   unsigned long addr = 0;
   size_t bytes = end - p;
 
   unsigned long addr = 0;
   size_t bytes = end - p;
 

+  assert (end > p);

   while (bytes)
     {
       int j;
   while (bytes)
     {
       int j;


@@ -12399,8 +13146,20 @@ display_msp430x_attribute (unsigned char * p,
 
       if (tag & 1)
        {
 
       if (tag & 1)
        {

-         printf ("\"%s\"\n", p);
-         p += strlen ((char *) p) + 1;
+         putchar ('"');
+         if (p < end - 1)
+           {
+             size_t maxlen = (end - p) - 1;
+
+             print_symbol ((int) maxlen, (const char *) p);
+             p += strnlen ((char *) p, maxlen) + 1;
+           }
+         else
+           {
+             printf (_("<corrupt>"));
+             p = (unsigned char *) end;
+           }
+         printf ("\"\n");

        }
       else
        {
        }
       else
        {


@@ -12411,6 +13170,7 @@ display_msp430x_attribute (unsigned char * p,
       break;
    }
 
       break;
    }
 

+  assert (p <= end);

   return p;
 }
 
   return p;
 }
 


@@ -12422,11 +13182,6 @@ process_attributes (FILE * file,
                    unsigned char * (* display_proc_gnu_attribute) (unsigned char *, int, const unsigned char * const))
 {
   Elf_Internal_Shdr * sect;
                    unsigned char * (* display_proc_gnu_attribute) (unsigned char *, int, const unsigned char * const))
 {
   Elf_Internal_Shdr * sect;

-  unsigned char * contents;
-  unsigned char * p;
-  unsigned char * end;
-  bfd_vma section_len;
-  bfd_vma len;

   unsigned i;
 
   /* Find the section header so that we get the size.  */
   unsigned i;
 
   /* Find the section header so that we get the size.  */


@@ -12434,6 +13189,9 @@ process_attributes (FILE * file,
        i < elf_header.e_shnum;
        i++, sect++)
     {
        i < elf_header.e_shnum;
        i++, sect++)
     {

+      unsigned char * contents;
+      unsigned char * p;
+

       if (sect->sh_type != proc_type && sect->sh_type != SHT_GNU_ATTRIBUTES)
        continue;
 
       if (sect->sh_type != proc_type && sect->sh_type != SHT_GNU_ATTRIBUTES)
        continue;
 


@@ -12445,36 +13203,52 @@ process_attributes (FILE * file,
       p = contents;
       if (*p == 'A')
        {
       p = contents;
       if (*p == 'A')
        {

-         len = sect->sh_size - 1;
+         bfd_vma section_len;
+
+         section_len = sect->sh_size - 1;

          p++;
 
          p++;
 

-         while (len > 0)
+         while (section_len > 0)

            {
            {

+             bfd_vma attr_len;

              unsigned int namelen;
              bfd_boolean public_section;
              bfd_boolean gnu_section;
 
              unsigned int namelen;
              bfd_boolean public_section;
              bfd_boolean gnu_section;
 

-             section_len = byte_get (p, 4);
+             if (section_len <= 4)
+               {
+                 error (_("Tag section ends prematurely\n"));
+                 break;
+               }
+             attr_len = byte_get (p, 4);

              p += 4;
 
              p += 4;
 

-             if (section_len > len)
+             if (attr_len > section_len)
+               {
+                 error (_("Bad attribute length (%u > %u)\n"),
+                         (unsigned) attr_len, (unsigned) section_len);
+                 attr_len = section_len;
+               }
+             /* PR 17531: file: 001-101425-0.004  */
+             else if (attr_len < 5)

                {
                {

-                 error (_("Length of attribute (%u) greater than length of section (%u)\n"),
-                         (unsigned) section_len, (unsigned) len);
-                 section_len = len;
+                 error (_("Attribute length of %u is too small\n"), (unsigned) attr_len);
+                 break;

                }
 
                }
 

-             len -= section_len;
-             section_len -= 4;
+             section_len -= attr_len;
+             attr_len -= 4;

 
 

-             namelen = strnlen ((char *) p, section_len) + 1;
-             if (namelen == 0 || namelen >= section_len)
+             namelen = strnlen ((char *) p, attr_len) + 1;
+             if (namelen == 0 || namelen >= attr_len)

                {
                  error (_("Corrupt attribute section name\n"));
                  break;
                }
 
                {
                  error (_("Corrupt attribute section name\n"));
                  break;
                }
 

-             printf (_("Attribute Section: %s\n"), p);
+             printf (_("Attribute Section: "));
+             print_symbol (INT_MAX, (const char *) p);
+             putchar ('\n');

 
              if (public_name && streq ((char *) p, public_name))
                public_section = TRUE;
 
              if (public_name && streq ((char *) p, public_name))
                public_section = TRUE;


@@ -12487,23 +13261,43 @@ process_attributes (FILE * file,
                gnu_section = FALSE;
 
              p += namelen;
                gnu_section = FALSE;
 
              p += namelen;

-             section_len -= namelen;
-             while (section_len > 0)
+             attr_len -= namelen;
+
+             while (attr_len > 0 && p < contents + sect->sh_size)

                {
                {

-                 int tag = *(p++);
+                 int tag;

                  int val;
                  bfd_vma size;
                  int val;
                  bfd_vma size;

+                 unsigned char * end;

 
 

+                 /* PR binutils/17531: Safe handling of corrupt files.  */
+                 if (attr_len < 6)
+                   {
+                     error (_("Unused bytes at end of section\n"));
+                     section_len = 0;
+                     break;
+                   }
+
+                 tag = *(p++);

                  size = byte_get (p, 4);
                  size = byte_get (p, 4);

-                 if (size > section_len)
+                 if (size > attr_len)

                    {
                      error (_("Bad subsection length (%u > %u)\n"),
                    {
                      error (_("Bad subsection length (%u > %u)\n"),

-                             (unsigned) size, (unsigned) section_len);
-                     size = section_len;
+                             (unsigned) size, (unsigned) attr_len);
+                     size = attr_len;
+                   }
+                 /* PR binutils/17531: Safe handling of corrupt files.  */
+                 if (size < 6)
+                   {
+                     error (_("Bad subsection length (%u < 6)\n"),
+                             (unsigned) size);
+                     section_len = 0;
+                     break;

                    }
 
                    }
 

-                 section_len -= size;
+                 attr_len -= size;

                  end = p + size - 1;
                  end = p + size - 1;

+                 assert (end <= contents + sect->sh_size);

                  p += 4;
 
                  switch (tag)
                  p += 4;
 
                  switch (tag)


@@ -12535,24 +13329,28 @@ process_attributes (FILE * file,
                      break;
                    }
 
                      break;
                    }
 

-                 if (public_section)
+                 if (public_section && display_pub_attribute != NULL)

                    {
                      while (p < end)
                        p = display_pub_attribute (p, end);
                    {
                      while (p < end)
                        p = display_pub_attribute (p, end);

+                     assert (p <= end);

                    }
                    }

-                 else if (gnu_section)
+                 else if (gnu_section && display_proc_gnu_attribute != NULL)

                    {
                      while (p < end)
                        p = display_gnu_attribute (p,
                                                   display_proc_gnu_attribute,
                                                   end);
                    {
                      while (p < end)
                        p = display_gnu_attribute (p,
                                                   display_proc_gnu_attribute,
                                                   end);

+                     assert (p <= end);

                    }
                    }

-                 else
+                 else if (p < end)

                    {
                    {

-                     printf (_("  Unknown section contexts\n"));
+                     printf (_("  Unknown attribute:\n"));

                      display_raw_attribute (p, end);
                      p = end;
                    }
                      display_raw_attribute (p, end);
                      p = end;
                    }

+                 else
+                   attr_len = 0;

                }
            }
        }
                }
            }
        }


@@ -12601,10 +13399,12 @@ process_msp430x_specific (FILE * file)
 
 /* DATA points to the contents of a MIPS GOT that starts at VMA PLTGOT.
    Print the Address, Access and Initial fields of an entry at VMA ADDR
 
 /* DATA points to the contents of a MIPS GOT that starts at VMA PLTGOT.
    Print the Address, Access and Initial fields of an entry at VMA ADDR

-   and return the VMA of the next entry.  */
+   and return the VMA of the next entry, or -1 if there was a problem.
+   Does not read from DATA_END or beyond.  */

 
 static bfd_vma
 
 static bfd_vma

-print_mips_got_entry (unsigned char * data, bfd_vma pltgot, bfd_vma addr)
+print_mips_got_entry (unsigned char * data, bfd_vma pltgot, bfd_vma addr,
+                     unsigned char * data_end)

 {
   printf ("  ");
   print_vma (addr, LONG_HEX);
 {
   printf ("  ");
   print_vma (addr, LONG_HEX);


@@ -12619,9 +13419,19 @@ print_mips_got_entry (unsigned char * data, bfd_vma pltgot, bfd_vma addr)
   else
     {
       bfd_vma entry;
   else
     {
       bfd_vma entry;

+      unsigned char * from = data + addr - pltgot;

 
 

-      entry = byte_get (data + addr - pltgot, is_32bit_elf ? 4 : 8);
-      print_vma (entry, LONG_HEX);
+      if (from + (is_32bit_elf ? 4 : 8) > data_end)
+       {
+         warn (_("MIPS GOT entry extends beyond the end of available data\n"));
+         printf ("%*s", is_32bit_elf ? 8 : 16, _("<corrupt>"));
+         return (bfd_vma) -1;
+       }
+      else
+       {
+         entry = byte_get (data + addr - pltgot, is_32bit_elf ? 4 : 8);
+         print_vma (entry, LONG_HEX);
+       }

     }
   return addr + (is_32bit_elf ? 4 : 8);
 }
     }
   return addr + (is_32bit_elf ? 4 : 8);
 }


@@ -12679,6 +13489,8 @@ print_mips_ases (unsigned int mask)
     fputs ("\n\tXPA ASE", stdout);
   if (mask == 0)
     fprintf (stdout, "\n\t%s", _("None"));
     fputs ("\n\tXPA ASE", stdout);
   if (mask == 0)
     fprintf (stdout, "\n\t%s", _("None"));

+  else if ((mask & ~AFL_ASE_MASK) != 0)
+    fprintf (stdout, "\n\t%s (%x)", _("Unknown"), mask & ~AFL_ASE_MASK);

 }
 
 static void
 }
 
 static void


@@ -12692,6 +13504,9 @@ print_mips_isa_ext (unsigned int isa_ext)
     case AFL_EXT_XLR:
       fputs ("RMI XLR", stdout);
       break;
     case AFL_EXT_XLR:
       fputs ("RMI XLR", stdout);
       break;

+    case AFL_EXT_OCTEON3:
+      fputs ("Cavium Networks Octeon3", stdout);
+      break;

     case AFL_EXT_OCTEON2:
       fputs ("Cavium Networks Octeon2", stdout);
       break;
     case AFL_EXT_OCTEON2:
       fputs ("Cavium Networks Octeon2", stdout);
       break;


@@ -12744,7 +13559,7 @@ print_mips_isa_ext (unsigned int isa_ext)
       fputs ("ST Microelectronics Loongson 2F", stdout);
       break;
     default:
       fputs ("ST Microelectronics Loongson 2F", stdout);
       break;
     default:

-      fputs (_("Unknown"), stdout);
+      fprintf (stdout, "%s (%d)", _("Unknown"), isa_ext);

     }
 }
 
     }
 }
 


@@ -12836,7 +13651,10 @@ process_mips_specific (FILE * file)
     /* No information available.  */
     return 0;
 
     /* No information available.  */
     return 0;
 

-  for (entry = dynamic_section; entry->d_tag != DT_NULL; ++entry)
+  for (entry = dynamic_section;
+       /* PR 17531 file: 012-50589-0.004.  */
+       entry < dynamic_section + dynamic_nent && entry->d_tag != DT_NULL;
+       ++entry)

     switch (entry->d_tag)
       {
       case DT_MIPS_LIBLIST:
     switch (entry->d_tag)
       {
       case DT_MIPS_LIBLIST:


@@ -12977,8 +13795,13 @@ process_mips_specific (FILE * file)
       sect = section_headers;
 
       /* Find the section header so that we get the size.  */
       sect = section_headers;
 
       /* Find the section header so that we get the size.  */

-      while (sect->sh_type != SHT_MIPS_OPTIONS)
-       ++sect;
+      sect = find_section_by_type (SHT_MIPS_OPTIONS);
+      /* PR 17533 file: 012-277276-0.004.  */ 
+      if (sect == NULL)
+       {
+         error (_("No MIPS_OPTIONS header found\n"));
+         return 0;
+       }

 
       eopt = (Elf_External_Options *) get_data (NULL, file, options_offset, 1,
                                                 sect->sh_size, _("options"));
 
       eopt = (Elf_External_Options *) get_data (NULL, file, options_offset, 1,
                                                 sect->sh_size, _("options"));


@@ -12988,14 +13811,14 @@ process_mips_specific (FILE * file)
               cmalloc ((sect->sh_size / sizeof (eopt)), sizeof (* iopt));
          if (iopt == NULL)
            {
               cmalloc ((sect->sh_size / sizeof (eopt)), sizeof (* iopt));
          if (iopt == NULL)
            {

-             error (_("Out of memory\n"));
+             error (_("Out of memory allocatinf space for MIPS options\n"));

              return 0;
            }
 
          offset = cnt = 0;
          option = iopt;
 
              return 0;
            }
 
          offset = cnt = 0;
          option = iopt;
 

-         while (offset < sect->sh_size)
+         while (offset <= sect->sh_size - sizeof (* eopt))

            {
              Elf_External_Options * eoption;
 
            {
              Elf_External_Options * eoption;
 


@@ -13006,16 +13829,25 @@ process_mips_specific (FILE * file)
              option->section = BYTE_GET (eoption->section);
              option->info = BYTE_GET (eoption->info);
 
              option->section = BYTE_GET (eoption->section);
              option->info = BYTE_GET (eoption->info);
 

+             /* PR 17531: file: ffa0fa3b.  */
+             if (option->size < sizeof (* eopt)
+                 || offset + option->size > sect->sh_size)
+               {
+                 warn (_("Invalid size (%u) for MIPS option\n"), option->size);
+                 option->size = sizeof (* eopt);
+                 break;
+               }

              offset += option->size;
              offset += option->size;

-
+               

              ++option;
              ++cnt;
            }
 
          printf (_("\nSection '%s' contains %d entries:\n"),
              ++option;
              ++cnt;
            }
 
          printf (_("\nSection '%s' contains %d entries:\n"),

-                 SECTION_NAME (sect), cnt);
+                 printable_section_name (sect), cnt);

 
          option = iopt;
 
          option = iopt;

+         offset = 0;

 
          while (cnt-- > 0)
            {
 
          while (cnt-- > 0)
            {


@@ -13152,13 +13984,18 @@ process_mips_specific (FILE * file)
 
              len = sizeof (* eopt);
              while (len < option->size)
 
              len = sizeof (* eopt);
              while (len < option->size)

-               if (((char *) option)[len] >= ' '
-                   && ((char *) option)[len] < 0x7f)
-                 printf ("%c", ((char *) option)[len++]);
-               else
-                 printf ("\\%03o", ((char *) option)[len++]);
+               {
+                 char datum = * ((char *) eopt + offset + len);

 
 

+                 if (ISPRINT (datum))
+                   printf ("%c", datum);
+                 else
+                   printf ("\\%03o", datum);
+                 len ++;
+               }

              fputs ("\n", stdout);
              fputs ("\n", stdout);

+
+             offset += option->size;

              ++option;
            }
 
              ++option;
            }
 


@@ -13180,7 +14017,7 @@ process_mips_specific (FILE * file)
       iconf = (Elf32_Conflict *) cmalloc (conflictsno, sizeof (* iconf));
       if (iconf == NULL)
        {
       iconf = (Elf32_Conflict *) cmalloc (conflictsno, sizeof (* iconf));
       if (iconf == NULL)
        {

-         error (_("Out of memory\n"));
+         error (_("Out of memory allocating space for dynamic conflicts\n"));

          return 0;
        }
 
          return 0;
        }
 


@@ -13221,15 +14058,22 @@ process_mips_specific (FILE * file)
 
       for (cnt = 0; cnt < conflictsno; ++cnt)
        {
 
       for (cnt = 0; cnt < conflictsno; ++cnt)
        {

-         Elf_Internal_Sym * psym = & dynamic_symbols[iconf[cnt]];
-

          printf ("%5lu: %8lu  ", (unsigned long) cnt, iconf[cnt]);
          printf ("%5lu: %8lu  ", (unsigned long) cnt, iconf[cnt]);

-         print_vma (psym->st_value, FULL_HEX);
-         putchar (' ');
-         if (VALID_DYNAMIC_NAME (psym->st_name))
-           print_symbol (25, GET_DYNAMIC_NAME (psym->st_name));
+
+         if (iconf[cnt] >= num_dynamic_syms)
+           printf (_("<corrupt symbol index>"));

          else
          else

-           printf (_("<corrupt: %14ld>"), psym->st_name);
+           {
+             Elf_Internal_Sym * psym;
+
+             psym = & dynamic_symbols[iconf[cnt]];
+             print_vma (psym->st_value, FULL_HEX);
+             putchar (' ');
+             if (VALID_DYNAMIC_NAME (psym->st_name))
+               print_symbol (25, GET_DYNAMIC_NAME (psym->st_name));
+             else
+               printf (_("<corrupt: %14ld>"), psym->st_name);
+           }

          putchar ('\n');
        }
 
          putchar ('\n');
        }
 


@@ -13241,19 +14085,36 @@ process_mips_specific (FILE * file)
       bfd_vma ent, local_end, global_end;
       size_t i, offset;
       unsigned char * data;
       bfd_vma ent, local_end, global_end;
       size_t i, offset;
       unsigned char * data;

+      unsigned char * data_end;

       int addr_size;
 
       ent = pltgot;
       addr_size = (is_32bit_elf ? 4 : 8);
       local_end = pltgot + local_gotno * addr_size;
       int addr_size;
 
       ent = pltgot;
       addr_size = (is_32bit_elf ? 4 : 8);
       local_end = pltgot + local_gotno * addr_size;

-      global_end = local_end + (symtabno - gotsym) * addr_size;

 
 

+      /* PR binutils/17533 file: 012-111227-0.004  */
+      if (symtabno < gotsym)
+       {
+         error (_("The GOT symbol offset (%lu) is greater than the symbol table size (%lu)\n"),
+                (unsigned long) gotsym, (unsigned long) symtabno);
+         return 0;
+       }
+
+      global_end = local_end + (symtabno - gotsym) * addr_size;
+      /* PR 17531: file: 54c91a34.  */
+      if (global_end < local_end)
+       {
+         error (_("Too many GOT symbols: %lu\n"), (unsigned long) symtabno);
+         return 0;
+       }
+      

       offset = offset_from_vma (file, pltgot, global_end - pltgot);
       data = (unsigned char *) get_data (NULL, file, offset,
                                          global_end - pltgot, 1,
                                         _("Global Offset Table data"));
       if (data == NULL)
        return 0;
       offset = offset_from_vma (file, pltgot, global_end - pltgot);
       data = (unsigned char *) get_data (NULL, file, offset,
                                          global_end - pltgot, 1,
                                         _("Global Offset Table data"));
       if (data == NULL)
        return 0;

+      data_end = data + (global_end - pltgot);

 
       printf (_("\nPrimary GOT:\n"));
       printf (_(" Canonical gp value: "));
 
       printf (_("\nPrimary GOT:\n"));
       printf (_(" Canonical gp value: "));


@@ -13264,14 +14125,18 @@ process_mips_specific (FILE * file)
       printf (_("  %*s %10s %*s Purpose\n"),
              addr_size * 2, _("Address"), _("Access"),
              addr_size * 2, _("Initial"));
       printf (_("  %*s %10s %*s Purpose\n"),
              addr_size * 2, _("Address"), _("Access"),
              addr_size * 2, _("Initial"));

-      ent = print_mips_got_entry (data, pltgot, ent);
+      ent = print_mips_got_entry (data, pltgot, ent, data_end);

       printf (_(" Lazy resolver\n"));
       printf (_(" Lazy resolver\n"));

+      if (ent == (bfd_vma) -1)
+       goto got_print_fail;

       if (data
          && (byte_get (data + ent - pltgot, addr_size)
              >> (addr_size * 8 - 1)) != 0)
        {
       if (data
          && (byte_get (data + ent - pltgot, addr_size)
              >> (addr_size * 8 - 1)) != 0)
        {

-         ent = print_mips_got_entry (data, pltgot, ent);
+         ent = print_mips_got_entry (data, pltgot, ent, data_end);

          printf (_(" Module pointer (GNU extension)\n"));
          printf (_(" Module pointer (GNU extension)\n"));

+         if (ent == (bfd_vma) -1)
+           goto got_print_fail;

        }
       printf ("\n");
 
        }
       printf ("\n");
 


@@ -13283,8 +14148,10 @@ process_mips_specific (FILE * file)
                  addr_size * 2, _("Initial"));
          while (ent < local_end)
            {
                  addr_size * 2, _("Initial"));
          while (ent < local_end)
            {

-             ent = print_mips_got_entry (data, pltgot, ent);
+             ent = print_mips_got_entry (data, pltgot, ent, data_end);

              printf ("\n");
              printf ("\n");

+             if (ent == (bfd_vma) -1)
+               goto got_print_fail;

            }
          printf ("\n");
        }
            }
          printf ("\n");
        }


@@ -13304,26 +14171,40 @@ process_mips_specific (FILE * file)
                  _("Ndx"), _("Name"));
 
          sym_width = (is_32bit_elf ? 80 : 160) - 28 - addr_size * 6 - 1;
                  _("Ndx"), _("Name"));
 
          sym_width = (is_32bit_elf ? 80 : 160) - 28 - addr_size * 6 - 1;

+

          for (i = gotsym; i < symtabno; i++)
            {
          for (i = gotsym; i < symtabno; i++)
            {

-             Elf_Internal_Sym * psym;
-
-             psym = dynamic_symbols + i;
-             ent = print_mips_got_entry (data, pltgot, ent);
+             ent = print_mips_got_entry (data, pltgot, ent, data_end);

              printf (" ");
              printf (" ");

-             print_vma (psym->st_value, LONG_HEX);
-             printf (" %-7s %3s ",
-                     get_symbol_type (ELF_ST_TYPE (psym->st_info)),
-                     get_symbol_index_type (psym->st_shndx));
-             if (VALID_DYNAMIC_NAME (psym->st_name))
-               print_symbol (sym_width, GET_DYNAMIC_NAME (psym->st_name));
+
+             if (dynamic_symbols == NULL)
+               printf (_("<no dynamic symbols>"));
+             else if (i < num_dynamic_syms)
+               {
+                 Elf_Internal_Sym * psym = dynamic_symbols + i;
+
+                 print_vma (psym->st_value, LONG_HEX);
+                 printf (" %-7s %3s ",
+                         get_symbol_type (ELF_ST_TYPE (psym->st_info)),
+                         get_symbol_index_type (psym->st_shndx));
+
+                 if (VALID_DYNAMIC_NAME (psym->st_name))
+                   print_symbol (sym_width, GET_DYNAMIC_NAME (psym->st_name));
+                 else
+                   printf (_("<corrupt: %14ld>"), psym->st_name);
+               }

              else
              else

-               printf (_("<corrupt: %14ld>"), psym->st_name);
+               printf (_("<symbol index %lu exceeds number of dynamic symbols>"),
+                       (unsigned long) i);
+

              printf ("\n");
              printf ("\n");

+             if (ent == (bfd_vma) -1)
+               break;

            }
          printf ("\n");
        }
 
            }
          printf ("\n");
        }
 

+    got_print_fail:

       if (data)
        free (data);
     }
       if (data)
        free (data);
     }


@@ -13377,19 +14258,26 @@ process_mips_specific (FILE * file)
       sym_width = (is_32bit_elf ? 80 : 160) - 17 - addr_size * 6 - 1;
       for (i = 0; i < count; i++)
        {
       sym_width = (is_32bit_elf ? 80 : 160) - 17 - addr_size * 6 - 1;
       for (i = 0; i < count; i++)
        {

-         Elf_Internal_Sym * psym;
+         unsigned long idx = get_reloc_symindex (rels[i].r_info);

 
 

-         psym = dynamic_symbols + get_reloc_symindex (rels[i].r_info);

          ent = print_mips_pltgot_entry (data, mips_pltgot, ent);
          printf (" ");
          ent = print_mips_pltgot_entry (data, mips_pltgot, ent);
          printf (" ");

-         print_vma (psym->st_value, LONG_HEX);
-         printf (" %-7s %3s ",
-                 get_symbol_type (ELF_ST_TYPE (psym->st_info)),
-                 get_symbol_index_type (psym->st_shndx));
-         if (VALID_DYNAMIC_NAME (psym->st_name))
-           print_symbol (sym_width, GET_DYNAMIC_NAME (psym->st_name));
+
+         if (idx >= num_dynamic_syms)
+           printf (_("<corrupt symbol index: %lu>"), idx);

          else
          else

-           printf (_("<corrupt: %14ld>"), psym->st_name);
+           {
+             Elf_Internal_Sym * psym = dynamic_symbols + idx;
+
+             print_vma (psym->st_value, LONG_HEX);
+             printf (" %-7s %3s ",
+                     get_symbol_type (ELF_ST_TYPE (psym->st_info)),
+                     get_symbol_index_type (psym->st_shndx));
+             if (VALID_DYNAMIC_NAME (psym->st_name))
+               print_symbol (sym_width, GET_DYNAMIC_NAME (psym->st_name));
+             else
+               printf (_("<corrupt: %14ld>"), psym->st_name);
+           }

          printf ("\n");
        }
       printf ("\n");
          printf ("\n");
        }
       printf ("\n");


@@ -13481,7 +14369,7 @@ process_gnu_liblist (FILE * file)
          strtab_size = string_sec->sh_size;
 
          printf (_("\nLibrary list section '%s' contains %lu entries:\n"),
          strtab_size = string_sec->sh_size;
 
          printf (_("\nLibrary list section '%s' contains %lu entries:\n"),

-                 SECTION_NAME (section),
+                 printable_section_name (section),

                  (unsigned long) (section->sh_size / sizeof (Elf32_External_Lib)));
 
          puts (_("     Library              Time Stamp          Checksum   Version Flags"));
                  (unsigned long) (section->sh_size / sizeof (Elf32_External_Lib)));
 
          puts (_("     Library              Time Stamp          Checksum   Version Flags"));


@@ -13745,6 +14633,13 @@ print_gnu_note (Elf_Internal_Note *pnote)
        unsigned long os, major, minor, subminor;
        const char *osname;
 
        unsigned long os, major, minor, subminor;
        const char *osname;
 

+       /* PR 17531: file: 030-599401-0.004.  */
+       if (pnote->descsz < 16)
+         {
+           printf (_("    <corrupt GNU_ABI_TAG>\n"));
+           break;
+         }
+

        os = byte_get ((unsigned char *) pnote->descdata, 4);
        major = byte_get ((unsigned char *) pnote->descdata + 4, 4);
        minor = byte_get ((unsigned char *) pnote->descdata + 8, 4);
        os = byte_get ((unsigned char *) pnote->descdata, 4);
        major = byte_get ((unsigned char *) pnote->descdata + 4, 4);
        minor = byte_get ((unsigned char *) pnote->descdata + 8, 4);


@@ -14153,6 +15048,9 @@ process_corefile_note_segment (FILE * file, bfd_vma offset, bfd_vma length)
 
       if (inote.descdata < (char *) external + min_notesz
          || next < (char *) external + min_notesz
 
       if (inote.descdata < (char *) external + min_notesz
          || next < (char *) external + min_notesz

+         /* PR binutils/17531: file: id:000000,sig:11,src:006986,op:havoc,rep:4.  */
+         || inote.namedata + inote.namesz < inote.namedata
+         || inote.descdata + inote.descsz < inote.descdata

          || data_remaining < (size_t)(next - (char *) external))
        {
          warn (_("note with invalid namesz and/or descsz found at offset 0x%lx\n"),
          || data_remaining < (size_t)(next - (char *) external))
        {
          warn (_("note with invalid namesz and/or descsz found at offset 0x%lx\n"),


@@ -14171,10 +15069,9 @@ process_corefile_note_segment (FILE * file, bfd_vma offset, bfd_vma length)
       if (inote.namedata[inote.namesz - 1] != '\0')
        {
          temp = (char *) malloc (inote.namesz + 1);
       if (inote.namedata[inote.namesz - 1] != '\0')
        {
          temp = (char *) malloc (inote.namesz + 1);

-

          if (temp == NULL)
            {
          if (temp == NULL)
            {

-             error (_("Out of memory\n"));
+             error (_("Out of memory allocating space for inote name\n"));

              res = 0;
              break;
            }
              res = 0;
              break;
            }


@@ -14388,9 +15285,9 @@ get_file_header (FILE * file)
       /* There may be some extensions in the first section header.  Don't
         bomb if we can't read it.  */
       if (is_32bit_elf)
       /* There may be some extensions in the first section header.  Don't
         bomb if we can't read it.  */
       if (is_32bit_elf)

-       get_32bit_section_headers (file, 1);
+       get_32bit_section_headers (file, TRUE);

       else
       else

-       get_64bit_section_headers (file, 1);
+       get_64bit_section_headers (file, TRUE);

     }
 
   return 1;
     }
 
   return 1;


@@ -14596,11 +15493,11 @@ process_archive (char * file_name, FILE * file, bfd_boolean is_thin_archive)
        error (_("%s: unable to dump the index as none was found\n"), file_name);
       else
        {
        error (_("%s: unable to dump the index as none was found\n"), file_name);
       else
        {

-         unsigned int i, l;
+         unsigned long i, l;

          unsigned long current_pos;
 
          unsigned long current_pos;
 

-         printf (_("Index of archive %s: (%ld entries, 0x%lx bytes in the symbol table)\n"),
-                 file_name, (long) arch.index_num, arch.sym_size);
+         printf (_("Index of archive %s: (%lu entries, 0x%lx bytes in the symbol table)\n"),
+                 file_name, (unsigned long) arch.index_num, arch.sym_size);

          current_pos = ftell (file);
 
          for (i = l = 0; i < arch.index_num; i++)
          current_pos = ftell (file);
 
          for (i = l = 0; i < arch.index_num; i++)


@@ -14631,8 +15528,9 @@ process_archive (char * file_name, FILE * file, bfd_boolean is_thin_archive)
                         file_name);
                  break;
                }
                         file_name);
                  break;
                }

-             printf ("\t%s\n", arch.sym_table + l);
-             l += strlen (arch.sym_table + l) + 1;
+             /* PR 17531: file: 0b6630b2.  */
+             printf ("\t%.*s\n", (int) (arch.sym_size - l), arch.sym_table + l);
+             l += strnlen (arch.sym_table + l, arch.sym_size - l) + 1;

            }
 
          if (arch.uses_64bit_indicies)
            }
 
          if (arch.uses_64bit_indicies)


@@ -14832,6 +15730,8 @@ process_file (char * file_name)
       return 1;
     }
 
       return 1;
     }
 

+  current_file_size = (bfd_size_type) statbuf.st_size;
+

   if (memcmp (armag, ARMAG, SARMAG) == 0)
     ret = process_archive (file_name, file, FALSE);
   else if (memcmp (armag, ARMAGT, SARMAG) == 0)
   if (memcmp (armag, ARMAG, SARMAG) == 0)
     ret = process_archive (file_name, file, FALSE);
   else if (memcmp (armag, ARMAGT, SARMAG) == 0)


@@ -14849,6 +15749,7 @@ process_file (char * file_name)
 
   fclose (file);
 
 
   fclose (file);
 

+  current_file_size = 0;

   return ret;
 }
 
   return ret;
 }