Blame SOURCES/binutils-CVE-2018-7570.patch

13ae24
--- binutils.orig/bfd/elf.c	2018-05-01 11:42:03.151425659 +0100
13ae24
+++ binutils-2.30/bfd/elf.c	2018-05-01 12:30:42.129206856 +0100
13ae24
@@ -5713,6 +5713,9 @@ assign_file_positions_for_load_sections
13ae24
   return TRUE;
13ae24
 }
13ae24
 
13ae24
+#define IS_TBSS(s) \
13ae24
+  ((s->flags & (SEC_THREAD_LOCAL | SEC_LOAD)) == SEC_THREAD_LOCAL)
13ae24
+
13ae24
 /* Assign file positions for the other sections.  */
13ae24
 
13ae24
 static bfd_boolean
13ae24
@@ -5862,65 +5865,100 @@ assign_file_positions_for_non_load_secti
13ae24
     {
13ae24
       if (p->p_type == PT_GNU_RELRO)
13ae24
 	{
13ae24
-	  const Elf_Internal_Phdr *lp;
13ae24
-	  struct elf_segment_map *lm;
13ae24
+	  bfd_vma start, end;
13ae24
+	  bfd_boolean ok;
13ae24
 
13ae24
 	  if (link_info != NULL)
13ae24
 	    {
13ae24
 	      /* During linking the range of the RELRO segment is passed
13ae24
-		 in link_info.  */
13ae24
+		 in link_info.  Note that there may be padding between
13ae24
+		 relro_start and the first RELRO section.  */
13ae24
+	      start = link_info->relro_start;
13ae24
+	      end = link_info->relro_end;
13ae24
+	    }
13ae24
+	  else if (m->count != 0)
13ae24
+	    {
13ae24
+	      if (!m->p_size_valid)
13ae24
+		abort ();
13ae24
+	      start = m->sections[0]->vma;
13ae24
+	      end = start + m->p_size;
13ae24
+	    }
13ae24
+	  else
13ae24
+	    {
13ae24
+	      start = 0;
13ae24
+	      end = 0;
13ae24
+	    }
13ae24
+
13ae24
+	  ok = FALSE;
13ae24
+	  if (start < end)
13ae24
+	    {
13ae24
+	      struct elf_segment_map *lm;
13ae24
+	      const Elf_Internal_Phdr *lp;
13ae24
+	      unsigned int i;
13ae24
+
13ae24
+	      /* Find a LOAD segment containing a section in the RELRO
13ae24
+		 segment.  */
13ae24
 	      for (lm = elf_seg_map (abfd), lp = phdrs;
13ae24
 		   lm != NULL;
13ae24
 		   lm = lm->next, lp++)
13ae24
 		{
13ae24
 		  if (lp->p_type == PT_LOAD
13ae24
-		      && lp->p_vaddr < link_info->relro_end
13ae24
 		      && lm->count != 0
13ae24
-		      && lm->sections[0]->vma >= link_info->relro_start)
13ae24
+		      && (lm->sections[lm->count - 1]->vma
13ae24
+			  + (!IS_TBSS (lm->sections[lm->count - 1])
13ae24
+			     ? lm->sections[lm->count - 1]->size
13ae24
+			     : 0)) > start
13ae24
+		      && lm->sections[0]->vma < end)
13ae24
 		    break;
13ae24
 		}
13ae24
 
13ae24
-	      BFD_ASSERT (lm != NULL);
13ae24
-	    }
13ae24
-	  else
13ae24
-	    {
13ae24
-	      /* Otherwise we are copying an executable or shared
13ae24
-		 library, but we need to use the same linker logic.  */
13ae24
-	      for (lp = phdrs; lp < phdrs + count; ++lp)
13ae24
+	      if (lm != NULL)
13ae24
 		{
13ae24
-		  if (lp->p_type == PT_LOAD
13ae24
-		      && lp->p_paddr == p->p_paddr)
13ae24
-		    break;
13ae24
+		  /* Find the section starting the RELRO segment.  */
13ae24
+		  for (i = 0; i < lm->count; i++)
13ae24
+		    {
13ae24
+		      asection *s = lm->sections[i];
13ae24
+		      if (s->vma >= start
13ae24
+			  && s->vma < end
13ae24
+			  && s->size != 0)
13ae24
+			break;
13ae24
+		    }
13ae24
+
13ae24
+		  if (i < lm->count)
13ae24
+		    {
13ae24
+		      p->p_vaddr = lm->sections[i]->vma;
13ae24
+		      p->p_paddr = lm->sections[i]->lma;
13ae24
+		      p->p_offset = lm->sections[i]->filepos;
13ae24
+		      p->p_memsz = end - p->p_vaddr;
13ae24
+		      p->p_filesz = p->p_memsz;
13ae24
+
13ae24
+		      /* The RELRO segment typically ends a few bytes
13ae24
+			 into .got.plt but other layouts are possible.
13ae24
+			 In cases where the end does not match any
13ae24
+			 loaded section (for instance is in file
13ae24
+			 padding), trim p_filesz back to correspond to
13ae24
+			 the end of loaded section contents.  */
13ae24
+		      if (p->p_filesz > lp->p_vaddr + lp->p_filesz - p->p_vaddr)
13ae24
+			p->p_filesz = lp->p_vaddr + lp->p_filesz - p->p_vaddr;
13ae24
+
13ae24
+		      /* Preserve the alignment and flags if they are
13ae24
+			 valid.  The gold linker generates RW/4 for
13ae24
+			 the PT_GNU_RELRO section.  It is better for
13ae24
+			 objcopy/strip to honor these attributes
13ae24
+			 otherwise gdb will choke when using separate
13ae24
+			 debug files.  */
13ae24
+		      if (!m->p_align_valid)
13ae24
+			p->p_align = 1;
13ae24
+		      if (!m->p_flags_valid)
13ae24
+			p->p_flags = PF_R;
13ae24
+		      ok = TRUE;
13ae24
+		    }
13ae24
 		}
13ae24
 	    }
13ae24
-
13ae24
-	  if (lp < phdrs + count)
13ae24
-	    {
13ae24
-	      p->p_vaddr = lp->p_vaddr;
13ae24
-	      p->p_paddr = lp->p_paddr;
13ae24
-	      p->p_offset = lp->p_offset;
13ae24
-	      if (link_info != NULL)
13ae24
-		p->p_filesz = link_info->relro_end - lp->p_vaddr;
13ae24
-	      else if (m->p_size_valid)
13ae24
-		p->p_filesz = m->p_size;
13ae24
-	      else
13ae24
-		abort ();
13ae24
-	      p->p_memsz = p->p_filesz;
13ae24
-	      /* Preserve the alignment and flags if they are valid. The
13ae24
-		 gold linker generates RW/4 for the PT_GNU_RELRO section.
13ae24
-		 It is better for objcopy/strip to honor these attributes
13ae24
-		 otherwise gdb will choke when using separate debug files.
13ae24
-	       */
13ae24
-	      if (!m->p_align_valid)
13ae24
-		p->p_align = 1;
13ae24
-	      if (!m->p_flags_valid)
13ae24
-		p->p_flags = PF_R;
13ae24
-	    }
13ae24
-	  else
13ae24
-	    {
13ae24
-	      memset (p, 0, sizeof *p);
13ae24
-	      p->p_type = PT_NULL;
13ae24
-	    }
13ae24
+	  if (link_info != NULL)
13ae24
+	    BFD_ASSERT (ok);
13ae24
+	  if (!ok)
13ae24
+	    memset (p, 0, sizeof *p);
13ae24
 	}
13ae24
       else if (p->p_type == PT_GNU_STACK)
13ae24
 	{