You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

63 lines
2.2 KiB

commit ec93045b400ec68b0c5716d75f27a87533b57058
Author: Nick Clifton <nickc@redhat.com>
Date: Tue Jan 6 17:54:02 2015 +0000
Fix memory access violations for objdump triggered by fuzzed binaries.
PR binutils/17512
* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
(bfd_perform_relocation): Include the size of the reloc in the
test for an out of range relocation.
(bfd_generic_get_relocated_section_contents): Remove reloc range
test.
### a/bfd/ChangeLog
### b/bfd/ChangeLog
## -1,6 +1,12 @@
2015-01-06 Nick Clifton <nickc@redhat.com>
PR binutils/17512
+ * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
+ (bfd_perform_relocation): Include the size of the reloc in the
+ test for an out of range relocation.
+ (bfd_generic_get_relocated_section_contents): Remove reloc range
+ test.
+
* coff-i860.c (CALC_ADDEND): Always set an addend value.
* tekhex.c (getvalue): Add an end pointer parameter. Use it to
avoid reading off the end of the buffer.
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
case 3: return 0;
case 4: return 8;
case 8: return 16;
+ case -1: return 2;
case -2: return 4;
default: abort ();
}
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
}
/* Is the address of the relocation really within the section? */
- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
+ if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
+ /* PR 17512: file: c146ab8b.
+ PR 17512: file: 46dff27f.
+ Include the size of the reloc in the test for out of range addresses. */
+ - bfd_get_reloc_size (howto))
return bfd_reloc_outofrange;
/* Work out which section the relocation is targeted at and the
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
(*parent)->howto = &none_howto;
r = bfd_reloc_ok;
}
- /* PR 17512: file: c146ab8b. */
- else if ((*parent)->address * bfd_octets_per_byte (abfd)
- >= bfd_get_section_size (input_section))
- r = bfd_reloc_outofrange;
else
r = bfd_perform_relocation (input_bfd,
*parent,