diff -rup binutils.orig/bfd/aoutx.h binutils-2.27/bfd/aoutx.h

--- binutils.orig/bfd/aoutx.h	2019-01-14 16:10:59.344958851 +0000

+++ binutils-2.27/bfd/aoutx.h	2019-01-14 16:11:46.893598783 +0000

@@ -118,6 +118,7 @@ DESCRIPTION

 #define KEEPIT udata.i

 #include "sysdep.h"

+#include <limits.h>

 #include "bfd.h"

 #include "safe-ctype.h"

 #include "bfdlink.h"

@@ -2465,6 +2466,8 @@ NAME (aout, canonicalize_reloc) (bfd *ab

 long

 NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect)

 {

+  bfd_size_type count;

+

   if (bfd_get_format (abfd) != bfd_object)

     {

       bfd_set_error (bfd_error_invalid_operation);

@@ -2472,26 +2475,25 @@ NAME (aout, get_reloc_upper_bound) (bfd

     }

   if (asect->flags & SEC_CONSTRUCTOR)

-    return sizeof (arelent *) * (asect->reloc_count + 1);

-

-  if (asect == obj_datasec (abfd))

-    return sizeof (arelent *)

-      * ((exec_hdr (abfd)->a_drsize / obj_reloc_entry_size (abfd))

-	 + 1);

-

-  if (asect == obj_textsec (abfd))

-    return sizeof (arelent *)

-      * ((exec_hdr (abfd)->a_trsize / obj_reloc_entry_size (abfd))

-	 + 1);

-

-  if (asect == obj_bsssec (abfd))

-    return sizeof (arelent *);

-

-  if (asect == obj_bsssec (abfd))

-    return 0;

+    count = asect->reloc_count;

+  else if (asect == obj_datasec (abfd))

+    count = exec_hdr (abfd)->a_drsize / obj_reloc_entry_size (abfd);

+  else if (asect == obj_textsec (abfd))

+    count = exec_hdr (abfd)->a_trsize / obj_reloc_entry_size (abfd);

+  else if (asect == obj_bsssec (abfd))

+    count = 0;

+  else

+    {

+      bfd_set_error (bfd_error_invalid_operation);

+      return -1;

+    }

-  bfd_set_error (bfd_error_invalid_operation);

-  return -1;

+  if (count >= LONG_MAX / sizeof (arelent *))

+    {

+      bfd_set_error (bfd_error_file_too_big);

+      return -1;

+    }

+  return (count + 1) * sizeof (arelent *);

 }

 long

diff -rup binutils.orig/bfd/elf.c binutils-2.27/bfd/elf.c

--- binutils.orig/bfd/elf.c	2019-01-14 16:10:59.331958950 +0000

+++ binutils-2.27/bfd/elf.c	2019-01-14 16:11:52.525556135 +0000

@@ -35,6 +35,7 @@ SECTION

 /* For sparc64-cross-sparc32.  */

 #define _SYSCALL32

 #include "sysdep.h"

+#include <limits.h>

 #include "bfd.h"

 #include "bfdlink.h"

 #include "libbfd.h"

@@ -7769,11 +7770,16 @@ Unable to find equivalent output section

 long

 _bfd_elf_get_symtab_upper_bound (bfd *abfd)

 {

-  long symcount;

+  bfd_size_type symcount;

   long symtab_size;

   Elf_Internal_Shdr *hdr = &elf_tdata (abfd)->symtab_hdr;

   symcount = hdr->sh_size / get_elf_backend_data (abfd)->s->sizeof_sym;

+  if (symcount >= LONG_MAX / sizeof (asymbol *))

+    {

+      bfd_set_error (bfd_error_file_too_big);

+      return -1;

+    }

   symtab_size = (symcount + 1) * (sizeof (asymbol *));

   if (symcount > 0)

     symtab_size -= sizeof (asymbol *);

@@ -7784,7 +7790,7 @@ _bfd_elf_get_symtab_upper_bound (bfd *ab

 long

 _bfd_elf_get_dynamic_symtab_upper_bound (bfd *abfd)

 {

-  long symcount;

+  bfd_size_type symcount;

   long symtab_size;

   Elf_Internal_Shdr *hdr = &elf_tdata (abfd)->dynsymtab_hdr;

@@ -7795,6 +7801,11 @@ _bfd_elf_get_dynamic_symtab_upper_bound

     }

   symcount = hdr->sh_size / get_elf_backend_data (abfd)->s->sizeof_sym;

+  if (symcount >= LONG_MAX / sizeof (asymbol *))

+    {

+      bfd_set_error (bfd_error_file_too_big);

+      return -1;

+    }

   symtab_size = (symcount + 1) * (sizeof (asymbol *));

   if (symcount > 0)

     symtab_size -= sizeof (asymbol *);

@@ -7864,7 +7875,7 @@ _bfd_elf_canonicalize_dynamic_symtab (bf

 long

 _bfd_elf_get_dynamic_reloc_upper_bound (bfd *abfd)

 {

-  long ret;

+  bfd_size_type count;

   asection *s;

   if (elf_dynsymtab (abfd) == 0)

@@ -7873,15 +7884,20 @@ _bfd_elf_get_dynamic_reloc_upper_bound (

       return -1;

     }

-  ret = sizeof (arelent *);

+  count = 1;

   for (s = abfd->sections; s != NULL; s = s->next)

     if (elf_section_data (s)->this_hdr.sh_link == elf_dynsymtab (abfd)

 	&& (elf_section_data (s)->this_hdr.sh_type == SHT_REL

 	    || elf_section_data (s)->this_hdr.sh_type == SHT_RELA))

-      ret += ((s->size / elf_section_data (s)->this_hdr.sh_entsize)

-	      * sizeof (arelent *));

-

-  return ret;

+      {

+	count += s->size / elf_section_data (s)->this_hdr.sh_entsize;

+	if (count > LONG_MAX / sizeof (arelent *))

+	  {

+	    bfd_set_error (bfd_error_file_too_big);

+	    return -1;

+	  }

+      }

+  return count * sizeof (arelent *);

 }

 /* Canonicalize the dynamic relocation entries.  Note that we return the