aboutsummaryrefslogtreecommitdiff
path: root/bfd/elf64-x86-64.c
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2018-10-13 22:03:02 +1030
committerAlan Modra <amodra@gmail.com>2018-10-13 23:54:33 +1030
commit0930cb3021b8078b34cf216e79eb8608d017864f (patch)
treec5368b36cb84da2d40b57d14e28432773ef161c9 /bfd/elf64-x86-64.c
parent2bf2bf23da5237f465fdbb759657aeb7825a08a3 (diff)
downloadgdb-0930cb3021b8078b34cf216e79eb8608d017864f.zip
gdb-0930cb3021b8078b34cf216e79eb8608d017864f.tar.gz
gdb-0930cb3021b8078b34cf216e79eb8608d017864f.tar.bz2
_bfd_clear_contents bounds checking
This PR shows a fuzzed binary triggering a segfault via a bad relocation in .debug_line. It turns out that unlike normal relocations applied to a section, the linker applies those with symbols from discarded sections via _bfd_clear_contents without checking that the relocation is within the section bounds. The same thing now happens when reading debug sections since commit a4cd947aca23, the PR23425 fix. PR 23770 PR 23425 * reloc.c (_bfd_clear_contents): Replace "location" param with "buf" and "off". Bounds check "off". Return status. * cofflink.c (_bfd_coff_generic_relocate_section): Update _bfd_clear_contents call. * elf-bfd.h (RELOC_AGAINST_DISCARDED_SECTION): Likewise. * elf32-arc.c (elf_arc_relocate_section): Likewise. * elf32-i386.c (elf_i386_relocate_section): Likewise. * elf32-metag.c (metag_final_link_relocate): Likewise. * elf32-nds32.c (nds32_elf_get_relocated_section_contents): Likewise. * elf32-ppc.c (ppc_elf_relocate_section): Likewise. * elf32-visium.c (visium_elf_relocate_section): Likewise. * elf64-ppc.c (ppc64_elf_relocate_section): Likewise. * elf64-x86-64.c *(elf_x86_64_relocate_section): Likewise. * libbfd-in.h (_bfd_clear_contents): Update prototype. * libbfd.h: Regenerate.
Diffstat (limited to 'bfd/elf64-x86-64.c')
-rw-r--r--bfd/elf64-x86-64.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
index c3a6c31..4dcab43 100644
--- a/bfd/elf64-x86-64.c
+++ b/bfd/elf64-x86-64.c
@@ -2490,7 +2490,7 @@ elf_x86_64_relocate_section (bfd *output_bfd,
if (sec != NULL && discarded_section (sec))
{
_bfd_clear_contents (howto, input_bfd, input_section,
- contents + rel->r_offset);
+ contents, rel->r_offset);
wrel->r_offset = rel->r_offset;
wrel->r_info = 0;
wrel->r_addend = 0;