diff options
| author | Nick Clifton <nickc@redhat.com> | 2015-01-06 17:54:02 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2015-01-06 17:54:02 +0000 |
| commit | ec93045b400ec68b0c5716d75f27a87533b57058 (patch) | |
| tree | 255a7168f3247cfd8107da8ab9f8a19c64497866 /bfd/reloc.c | |
| parent | 60ebc25751744f54ae5c00d1c9198ab64fcc5b33 (diff) | |
| download | gdb-ec93045b400ec68b0c5716d75f27a87533b57058.zip gdb-ec93045b400ec68b0c5716d75f27a87533b57058.tar.gz gdb-ec93045b400ec68b0c5716d75f27a87533b57058.tar.bz2 | |
Fix memory access violations for objdump triggered by fuzzed binaries.
PR binutils/17512
* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
(bfd_perform_relocation): Include the size of the reloc in the
test for an out of range relocation.
(bfd_generic_get_relocated_section_contents): Remove reloc range
test.
Diffstat (limited to 'bfd/reloc.c')
| -rw-r--r-- | bfd/reloc.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/bfd/reloc.c b/bfd/reloc.c index fe7d8be..4167608 100644 --- a/bfd/reloc.c +++ b/bfd/reloc.c @@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto) case 3: return 0; case 4: return 8; case 8: return 16; + case -1: return 2; case -2: return 4; default: abort (); } @@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd, } /* Is the address of the relocation really within the section? */ - if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) + if (reloc_entry->address > bfd_get_section_limit (abfd, input_section) + /* PR 17512: file: c146ab8b. + PR 17512: file: 46dff27f. + Include the size of the reloc in the test for out of range addresses. */ + - bfd_get_reloc_size (howto)) return bfd_reloc_outofrange; /* Work out which section the relocation is targeted at and the @@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd, (*parent)->howto = &none_howto; r = bfd_reloc_ok; } - /* PR 17512: file: c146ab8b. */ - else if ((*parent)->address * bfd_octets_per_byte (abfd) - >= bfd_get_section_size (input_section)) - r = bfd_reloc_outofrange; else r = bfd_perform_relocation (input_bfd, *parent, |