You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
62 lines
2.2 KiB
62 lines
2.2 KiB
commit ec93045b400ec68b0c5716d75f27a87533b57058 |
|
Author: Nick Clifton <nickc@redhat.com> |
|
Date: Tue Jan 6 17:54:02 2015 +0000 |
|
|
|
Fix memory access violations for objdump triggered by fuzzed binaries. |
|
|
|
PR binutils/17512 |
|
* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1. |
|
(bfd_perform_relocation): Include the size of the reloc in the |
|
test for an out of range relocation. |
|
(bfd_generic_get_relocated_section_contents): Remove reloc range |
|
test. |
|
|
|
### a/bfd/ChangeLog |
|
### b/bfd/ChangeLog |
|
## -1,6 +1,12 @@ |
|
2015-01-06 Nick Clifton <nickc@redhat.com> |
|
|
|
PR binutils/17512 |
|
+ * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1. |
|
+ (bfd_perform_relocation): Include the size of the reloc in the |
|
+ test for an out of range relocation. |
|
+ (bfd_generic_get_relocated_section_contents): Remove reloc range |
|
+ test. |
|
+ |
|
* coff-i860.c (CALC_ADDEND): Always set an addend value. |
|
* tekhex.c (getvalue): Add an end pointer parameter. Use it to |
|
avoid reading off the end of the buffer. |
|
--- a/bfd/reloc.c |
|
+++ b/bfd/reloc.c |
|
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto) |
|
case 3: return 0; |
|
case 4: return 8; |
|
case 8: return 16; |
|
+ case -1: return 2; |
|
case -2: return 4; |
|
default: abort (); |
|
} |
|
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd, |
|
} |
|
|
|
/* Is the address of the relocation really within the section? */ |
|
- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) |
|
+ if (reloc_entry->address > bfd_get_section_limit (abfd, input_section) |
|
+ /* PR 17512: file: c146ab8b. |
|
+ PR 17512: file: 46dff27f. |
|
+ Include the size of the reloc in the test for out of range addresses. */ |
|
+ - bfd_get_reloc_size (howto)) |
|
return bfd_reloc_outofrange; |
|
|
|
/* Work out which section the relocation is targeted at and the |
|
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd, |
|
(*parent)->howto = &none_howto; |
|
r = bfd_reloc_ok; |
|
} |
|
- /* PR 17512: file: c146ab8b. */ |
|
- else if ((*parent)->address * bfd_octets_per_byte (abfd) |
|
- >= bfd_get_section_size (input_section)) |
|
- r = bfd_reloc_outofrange; |
|
else |
|
r = bfd_perform_relocation (input_bfd, |
|
*parent,
|
|
|