From ec1f73bb0be7482f2dffd9bbca2f93fc74eca172 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Mon, 1 Feb 2016 21:27:02 +1030 Subject: x86 synthetic plt symbols Changing "pushq $1" in the following to "pushq $too_big" results in an abort. BFD shouldn't abort on (deliberately) bad user input. 400480: ff 25 9a 0b 20 00 jmpq *0x200b9a(%rip) 400486: 68 01 00 00 00 pushq $0x1 40048b: e9 d0 ff ff ff jmpq 400460 <_init+0x20> * elf64-x86-64.c (elf_x86_64_get_plt_sym_val): Don't abort on an out of range reloc_index. * elf32-i386.c (elf_i386_get_plt_sym_val): Likewise. --- bfd/elf64-x86-64.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) (limited to 'bfd/elf64-x86-64.c') diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c index 37528be..88ed00e 100644 --- a/bfd/elf64-x86-64.c +++ b/bfd/elf64-x86-64.c @@ -6066,19 +6066,20 @@ bad_return: reloc_index = H_GET_32 (abfd, (plt_contents + plt_offset + bed->plt_reloc_offset)); - if (reloc_index >= count) - abort (); - if (plt_bnd) + if (reloc_index < count) { - /* This is the index in .plt section. */ - long plt_index = plt_offset / bed->plt_entry_size; - /* Store VMA + the offset in .plt.bnd section. */ - plt_sym_val[reloc_index] = - (plt_bnd->vma - + (plt_index - 1) * sizeof (elf_x86_64_legacy_plt2_entry)); + if (plt_bnd) + { + /* This is the index in .plt section. */ + long plt_index = plt_offset / bed->plt_entry_size; + /* Store VMA + the offset in .plt.bnd section. */ + plt_sym_val[reloc_index] = + (plt_bnd->vma + + (plt_index - 1) * sizeof (elf_x86_64_legacy_plt2_entry)); + } + else + plt_sym_val[reloc_index] = plt->vma + plt_offset; } - else - plt_sym_val[reloc_index] = plt->vma + plt_offset; plt_offset += bed->plt_entry_size; /* PR binutils/18437: Skip extra relocations in the .rela.plt -- cgit v1.1