aboutsummaryrefslogtreecommitdiff
path: root/bfd
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2022-11-23 22:12:30 +1030
committerAlan Modra <amodra@gmail.com>2022-11-23 22:38:48 +1030
commite6b6fad2fe4d180bcd65a1e0aabc6ba763901346 (patch)
treebc1ceb0e32d8f6a15365185e2947bc6d724dd0e0 /bfd
parentd499fb89448c3f2e061813f12a1b63fbaa29422e (diff)
downloadgdb-e6b6fad2fe4d180bcd65a1e0aabc6ba763901346.zip
gdb-e6b6fad2fe4d180bcd65a1e0aabc6ba763901346.tar.gz
gdb-e6b6fad2fe4d180bcd65a1e0aabc6ba763901346.tar.bz2
PR22509 - Null pointer dereference on coff_slurp_reloc_table
This extends the commit 4581a1c7d304 fix to more targets, which hardens BFD a little. I think the real underlying problem was the bfd_canonicalize_reloc call in load_specific_debug_section which passed a NULL for "symbols". Fix that too. PR 22509 bfd/ * aoutx.h (swap_ext_reloc_out): Gracefully handle NULL symbols. * i386lynx.c (swap_ext_reloc_out): Likewise. * pdp11.c (pdp11_aout_swap_reloc_out): Likewise. * coff-tic30.c (reloc_processing): Likewise. * coff-tic4x.c (tic4x_reloc_processing): Likewise. * coff-tic54x.c (tic54x_reloc_processing): Likewise. * coff-z80.c (reloc_processing): Likewise. * coff-z8k.c (reloc_processing): Likewise. * ecoff.c (ecoff_slurp_reloc_table): Likewise. * som.c (som_set_reloc_info): Likewise. binutils/ * objdump.c (load_specific_debug_section): Pass syms to bfd_canonicalize_reloc.
Diffstat (limited to 'bfd')
-rw-r--r--bfd/aoutx.h4
-rw-r--r--bfd/coff-tic30.c2
-rw-r--r--bfd/coff-tic4x.c2
-rw-r--r--bfd/coff-tic54x.c2
-rw-r--r--bfd/coff-z80.c2
-rw-r--r--bfd/coff-z8k.c2
-rw-r--r--bfd/ecoff.c3
-rw-r--r--bfd/i386lynx.c4
-rw-r--r--bfd/pdp11.c4
-rw-r--r--bfd/som.c2
10 files changed, 17 insertions, 10 deletions
diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index 61ea9f7..38e3043 100644
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -2122,8 +2122,10 @@ NAME (aout, swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* Undefined symbol. */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
diff --git a/bfd/coff-tic30.c b/bfd/coff-tic30.c
index 874fd79..fcc8575 100644
--- a/bfd/coff-tic30.c
+++ b/bfd/coff-tic30.c
@@ -161,7 +161,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
diff --git a/bfd/coff-tic4x.c b/bfd/coff-tic4x.c
index 02013e1..be29525 100644
--- a/bfd/coff-tic4x.c
+++ b/bfd/coff-tic4x.c
@@ -219,7 +219,7 @@ tic4x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
- if (reloc->r_symndx != -1)
+ if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{
diff --git a/bfd/coff-tic54x.c b/bfd/coff-tic54x.c
index 8b49358..9ec4b20 100644
--- a/bfd/coff-tic54x.c
+++ b/bfd/coff-tic54x.c
@@ -357,7 +357,7 @@ tic54x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
- if (reloc->r_symndx != -1)
+ if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{
diff --git a/bfd/coff-z80.c b/bfd/coff-z80.c
index ba0f260..7fb2f13 100644
--- a/bfd/coff-z80.c
+++ b/bfd/coff-z80.c
@@ -314,7 +314,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
diff --git a/bfd/coff-z8k.c b/bfd/coff-z8k.c
index b9f6f97..974bffc 100644
--- a/bfd/coff-z8k.c
+++ b/bfd/coff-z8k.c
@@ -177,7 +177,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
diff --git a/bfd/ecoff.c b/bfd/ecoff.c
index a4edf7a..2d26b85 100644
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -1612,7 +1612,8 @@ ecoff_slurp_reloc_table (bfd *abfd,
if (intern.r_extern)
{
/* r_symndx is an index into the external symbols. */
- if (intern.r_symndx >= 0
+ if (symbols != NULL
+ && intern.r_symndx >= 0
&& (intern.r_symndx
< (ecoff_data (abfd)->debug_info.symbolic_header.iextMax)))
rptr->sym_ptr_ptr = symbols + intern.r_symndx;
diff --git a/bfd/i386lynx.c b/bfd/i386lynx.c
index 5df3d19..acc38d2 100644
--- a/bfd/i386lynx.c
+++ b/bfd/i386lynx.c
@@ -283,8 +283,10 @@ NAME(lynx,swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* undefined symbol */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
diff --git a/bfd/pdp11.c b/bfd/pdp11.c
index de9c869..806e0e1 100644
--- a/bfd/pdp11.c
+++ b/bfd/pdp11.c
@@ -1861,8 +1861,10 @@ pdp11_aout_swap_reloc_out (bfd *abfd, arelent *g, bfd_byte *natptr)
if (r_extern) \
{ \
/* Undefined symbol. */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
diff --git a/bfd/som.c b/bfd/som.c
index 7a5ee35..3e89c93 100644
--- a/bfd/som.c
+++ b/bfd/som.c
@@ -5099,7 +5099,7 @@ som_set_reloc_info (unsigned char *fixup,
/* A symbol to use in the relocation. Make a note
of this if we are not just counting. */
case 'S':
- if (! just_count && (unsigned int) c < symcount)
+ if (!just_count && symbols != NULL && (unsigned int) c < symcount)
rptr->sym_ptr_ptr = &symbols[c];
break;
/* Argument relocation bits for a function call. */