4 files changed, 29 insertions, 0 deletions
diff --git a/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0080.macho b/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0080.macho
new file mode 100644
index 00000000000..53e3a97b4aa
--- /dev/null
+++ b/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0080.macho
diff --git a/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0261.macho b/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0261.macho
new file mode 100644
index 00000000000..a573da3b2fb
--- /dev/null
+++ b/llvm/test/tools/llvm-objdump/Inputs/malformed-machos/mem-crup-0261.macho
diff --git a/llvm/test/tools/llvm-objdump/malformed-machos.test b/llvm/test/tools/llvm-objdump/malformed-machos.test
index 2167c706550..732cdb665b9 100644
--- a/llvm/test/tools/llvm-objdump/malformed-machos.test
+++ b/llvm/test/tools/llvm-objdump/malformed-machos.test
@@ -24,3 +24,12 @@
 # RUN:   | FileCheck -check-prefix=m0040 %s 
 
 # m0040: 00000000000010a0 0xf39 -[tiny_dylib init]
+
+# RUN: llvm-objdump -macho -objc-meta-data \
+# RUN:   %p/Inputs/malformed-machos/mem-crup-0080.macho \
+# RUN:   | FileCheck -check-prefix=m0080 %s 
+
+# m0080: data 0xf960000 (struct class_ro_t *)
+
+# RUN: llvm-objdump -macho -objc-meta-data \
+# RUN:   %p/Inputs/malformed-machos/mem-crup-0261.macho
diff --git a/llvm/tools/llvm-objdump/MachODump.cpp b/llvm/tools/llvm-objdump/MachODump.cpp
index 993e9e6817b..9682e4a3307 100644
--- a/llvm/tools/llvm-objdump/MachODump.cpp
+++ b/llvm/tools/llvm-objdump/MachODump.cpp
@@ -4984,6 +4984,9 @@ static void print_image_info64(SectionRef S, struct DisassembleInfo *info) {
   struct objc_image_info64 o;
   const char *r;
 
+  if (S == SectionRef())
+    return;
+
   StringRef SectName;
   S.getName(SectName);
   DataRefImpl Ref = S.getRawDataRefImpl();
@@ -8498,6 +8501,7 @@ public:
   StringRef segmentName(uint32_t SegIndex);
   StringRef sectionName(uint32_t SegIndex, uint64_t SegOffset);
   uint64_t address(uint32_t SegIndex, uint64_t SegOffset);
+  bool isValidSegIndexAndOffset(uint32_t SegIndex, uint64_t SegOffset);
 
 private:
   struct SectionInfo {
@@ -8546,6 +8550,20 @@ StringRef SegInfo::segmentName(uint32_t SegIndex) {
   llvm_unreachable("invalid segIndex");
 }
 
+bool SegInfo::isValidSegIndexAndOffset(uint32_t SegIndex,
+                                       uint64_t OffsetInSeg) {
+  for (const SectionInfo &SI : Sections) {
+    if (SI.SegmentIndex != SegIndex)
+      continue;
+    if (SI.OffsetInSegment > OffsetInSeg)
+      continue;
+    if (OffsetInSeg >= (SI.OffsetInSegment + SI.Size))
+      continue;
+    return true;
+  }
+  return false;
+}
+
 const SegInfo::SectionInfo &SegInfo::findSection(uint32_t SegIndex,
                                                  uint64_t OffsetInSeg) {
   for (const SectionInfo &SI : Sections) {
@@ -8714,6 +8732,8 @@ static const char *get_dyld_bind_info_symbolname(uint64_t ReferenceValue,
     for (const llvm::object::MachOBindEntry &Entry : info->O->bindTable()) {
       uint32_t SegIndex = Entry.segmentIndex();
       uint64_t OffsetInSeg = Entry.segmentOffset();
+      if (!sectionTable.isValidSegIndexAndOffset(SegIndex, OffsetInSeg))
+        continue;
       uint64_t Address = sectionTable.address(SegIndex, OffsetInSeg);
       const char *SymbolName = nullptr;
       StringRef name = Entry.symbolName();