diff options
| author | Alan Modra <amodra@gmail.com> | 2018-01-27 08:19:33 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2018-01-29 15:50:01 +1030 |
| commit | eb77f6a4621795367a39cdd30957903af9dbb815 (patch) | |
| tree | caae4bb77ae4c9c24dfd1d72555f23f448735563 /bfd/coffgen.c | |
| parent | 0d5e2f6abee322730eea6d7c175ae24631d3b089 (diff) | |
| download | binutils-eb77f6a4621795367a39cdd30957903af9dbb815.zip binutils-eb77f6a4621795367a39cdd30957903af9dbb815.tar.gz binutils-eb77f6a4621795367a39cdd30957903af9dbb815.tar.bz2 | |
PR22741, objcopy segfault on fuzzed COFF object
PR 22741
* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
range before converting to a symbol table pointer.
Diffstat (limited to 'bfd/coffgen.c')
| -rw-r--r-- | bfd/coffgen.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/bfd/coffgen.c b/bfd/coffgen.c index b241087..4f90ead 100644 --- a/bfd/coffgen.c +++ b/bfd/coffgen.c @@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd, } /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can generate one, so we must be careful to ignore it. */ - if (auxent->u.auxent.x_sym.x_tagndx.l > 0) + if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l + < obj_raw_syment_count (abfd)) { auxent->u.auxent.x_sym.x_tagndx.p = table_base + auxent->u.auxent.x_sym.x_tagndx.l; |