|
 |
a094f6 |
commit ec93045b400ec68b0c5716d75f27a87533b57058
|
|
|
a094f6 |
Author: Nick Clifton <nickc@redhat.com>
|
|
|
a094f6 |
Date: Tue Jan 6 17:54:02 2015 +0000
|
|
|
a094f6 |
|
|
|
a094f6 |
Fix memory access violations for objdump triggered by fuzzed binaries.
|
|
|
a094f6 |
|
|
|
a094f6 |
PR binutils/17512
|
|
|
a094f6 |
* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
|
|
|
a094f6 |
(bfd_perform_relocation): Include the size of the reloc in the
|
|
|
a094f6 |
test for an out of range relocation.
|
|
|
a094f6 |
(bfd_generic_get_relocated_section_contents): Remove reloc range
|
|
|
a094f6 |
test.
|
|
|
a094f6 |
|
|
|
a094f6 |
### a/bfd/ChangeLog
|
|
|
a094f6 |
### b/bfd/ChangeLog
|
|
|
a094f6 |
## -1,6 +1,12 @@
|
|
|
a094f6 |
2015-01-06 Nick Clifton <nickc@redhat.com>
|
|
|
a094f6 |
|
|
|
a094f6 |
PR binutils/17512
|
|
|
a094f6 |
+ * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
|
|
|
a094f6 |
+ (bfd_perform_relocation): Include the size of the reloc in the
|
|
|
a094f6 |
+ test for an out of range relocation.
|
|
|
a094f6 |
+ (bfd_generic_get_relocated_section_contents): Remove reloc range
|
|
|
a094f6 |
+ test.
|
|
|
a094f6 |
+
|
|
|
a094f6 |
* coff-i860.c (CALC_ADDEND): Always set an addend value.
|
|
|
a094f6 |
* tekhex.c (getvalue): Add an end pointer parameter. Use it to
|
|
|
a094f6 |
avoid reading off the end of the buffer.
|
|
|
a094f6 |
--- a/bfd/reloc.c
|
|
|
a094f6 |
+++ b/bfd/reloc.c
|
|
|
a094f6 |
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
|
|
|
a094f6 |
case 3: return 0;
|
|
|
a094f6 |
case 4: return 8;
|
|
|
a094f6 |
case 8: return 16;
|
|
|
a094f6 |
+ case -1: return 2;
|
|
|
a094f6 |
case -2: return 4;
|
|
|
a094f6 |
default: abort ();
|
|
|
a094f6 |
}
|
|
|
a094f6 |
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
|
|
|
a094f6 |
}
|
|
|
a094f6 |
|
|
|
a094f6 |
/* Is the address of the relocation really within the section? */
|
|
|
a094f6 |
- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
|
|
|
a094f6 |
+ if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
|
|
|
a094f6 |
+ /* PR 17512: file: c146ab8b.
|
|
|
a094f6 |
+ PR 17512: file: 46dff27f.
|
|
|
a094f6 |
+ Include the size of the reloc in the test for out of range addresses. */
|
|
|
a094f6 |
+ - bfd_get_reloc_size (howto))
|
|
|
a094f6 |
return bfd_reloc_outofrange;
|
|
|
a094f6 |
|
|
|
a094f6 |
/* Work out which section the relocation is targeted at and the
|
|
|
a094f6 |
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
|
|
|
a094f6 |
(*parent)->howto = &none_howto;
|
|
|
a094f6 |
r = bfd_reloc_ok;
|
|
|
a094f6 |
}
|
|
|
a094f6 |
- /* PR 17512: file: c146ab8b. */
|
|
|
a094f6 |
- else if ((*parent)->address * bfd_octets_per_byte (abfd)
|
|
|
a094f6 |
- >= bfd_get_section_size (input_section))
|
|
|
a094f6 |
- r = bfd_reloc_outofrange;
|
|
|
a094f6 |
else
|
|
|
a094f6 |
r = bfd_perform_relocation (input_bfd,
|
|
|
a094f6 |
*parent,
|