diff options
| author | Alan Modra <amodra@gmail.com> | 2017-04-29 14:48:16 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2017-04-29 18:59:37 +0930 |
| commit | a941291cab71b9ac356e1c03968c177c03e602ab (patch) | |
| tree | d65e215e50c613debf66d04caedaef757d4d2839 /bfd/reloc.c | |
| parent | 45ce1b47e4490993b5c1a04f4a8acb62d9ec5039 (diff) | |
| download | gdb-a941291cab71b9ac356e1c03968c177c03e602ab.zip gdb-a941291cab71b9ac356e1c03968c177c03e602ab.tar.gz gdb-a941291cab71b9ac356e1c03968c177c03e602ab.tar.bz2 | |
PR21432, buffer overflow in perform_relocation
The existing reloc offset range tests didn't catch small negative
offsets less than the size of the reloc field.
PR 21432
* reloc.c (reloc_offset_in_range): New function.
(bfd_perform_relocation, bfd_install_relocation): Use it.
(_bfd_final_link_relocate): Likewise.
Diffstat (limited to 'bfd/reloc.c')
| -rw-r--r-- | bfd/reloc.c | 32 |
1 files changed, 20 insertions, 12 deletions
diff --git a/bfd/reloc.c b/bfd/reloc.c index 9a04022..12520d1 100644 --- a/bfd/reloc.c +++ b/bfd/reloc.c @@ -538,6 +538,22 @@ bfd_check_overflow (enum complain_overflow how, return flag; } +/* HOWTO describes a relocation, at offset OCTET. Return whether the + relocation field is within SECTION of ABFD. */ + +static bfd_boolean +reloc_offset_in_range (reloc_howto_type *howto, bfd *abfd, + asection *section, bfd_size_type octet) +{ + bfd_size_type octet_end = bfd_get_section_limit_octets (abfd, section); + bfd_size_type reloc_size = bfd_get_reloc_size (howto); + + /* The reloc field must be contained entirely within the section. + Allow zero length fields (marker relocs or NONE relocs where no + relocation will be performed) at the end of the section. */ + return octet <= octet_end && octet + reloc_size <= octet_end; +} + /* FUNCTION bfd_perform_relocation @@ -619,15 +635,9 @@ bfd_perform_relocation (bfd *abfd, if (howto == NULL) return bfd_reloc_undefined; - /* Is the address of the relocation really within the section? - Include the size of the reloc in the test for out of range addresses. - PR 17512: file: c146ab8b, 46dff27f, 38e53ebf. */ + /* Is the address of the relocation really within the section? */ octets = reloc_entry->address * bfd_octets_per_byte (abfd); - if (octets + bfd_get_reloc_size (howto) - > bfd_get_section_limit_octets (abfd, input_section) - /* Check for an overly large offset which - masquerades as a negative value too. */ - || (octets + bfd_get_reloc_size (howto) < bfd_get_reloc_size (howto))) + if (!reloc_offset_in_range (howto, abfd, input_section, octets)) return bfd_reloc_outofrange; /* Work out which section the relocation is targeted at and the @@ -1015,8 +1025,7 @@ bfd_install_relocation (bfd *abfd, /* Is the address of the relocation really within the section? */ octets = reloc_entry->address * bfd_octets_per_byte (abfd); - if (octets + bfd_get_reloc_size (howto) - > bfd_get_section_limit_octets (abfd, input_section)) + if (!reloc_offset_in_range (howto, abfd, input_section, octets)) return bfd_reloc_outofrange; /* Work out which section the relocation is targeted at and the @@ -1354,8 +1363,7 @@ _bfd_final_link_relocate (reloc_howto_type *howto, bfd_size_type octets = address * bfd_octets_per_byte (input_bfd); /* Sanity check the address. */ - if (octets + bfd_get_reloc_size (howto) - > bfd_get_section_limit_octets (input_bfd, input_section)) + if (!reloc_offset_in_range (howto, input_bfd, input_section, octets)) return bfd_reloc_outofrange; /* This function assumes that we are dealing with a basic relocation |