Blame SOURCES/gdb-rhbz1320945-power9-11of38.patch

a094f6
commit cd21f5daad4335b50366b838664ade64bec29957
a094f6
Author: Nick Clifton <nickc@redhat.com>
a094f6
Date:   Thu Jan 15 16:22:55 2015 +0000
a094f6
a094f6
    Fix memory access violations triggered by running objdump on fuzzed binaries.
a094f6
    
a094f6
            PR binutils/17512
a094f6
            * elf-m10300.c (mn10300_info_to_howto): Replace assertion with an
a094f6
            error message.  Never return an invalid howto pointer.
a094f6
            * elf32-cr16.c (cr16_info_to_howto): Likewise.
a094f6
            * elf32-crx.c (elf_crx_info_to_howto): Likewise.
a094f6
            * elf32-i370.c (i370_elf_info_to_howto): Likewise.
a094f6
            * elf32-mcore.c (mcore_elf_info_to_howto): Likewise.
a094f6
            * elf32-microblaze.c (microblaze_elf_info_to_howto): Likewise.
a094f6
            * elf32-mips.c (mips_elf32_rtype_to_howto): Likewise.
a094f6
            * elf32-pj.c (pj_elf_info_to_howto): Likewise.
a094f6
            * elf32-ppc.c (ppc_elf_info_to_howto): Likewise.
a094f6
            * elf32-spu.c (spu_elf_info_to_howto): Likewise.
a094f6
            * elf32-v850.c (v850_elf_info_to_howto_rela): Likewise.
a094f6
            * elf32-vax.c (rtype_to_howto): Likewise.
a094f6
            * elf64-alpha.c (elf64_alpha_info_to_howto): Likewise.
a094f6
            * elf64-mips.c (mips_elf64_rtype_to_howto): Likewise.
a094f6
            * elfn32-mips.c (sh_elf_info_to_howto): Likewise.
a094f6
            * elf32-sh.c (sh_elf_info_to_howto): Likewise.
a094f6
            (sh_elf_reloc): Check that the reloc is in range.
a094f6
            * reloc.c (bfd_perform_relocation): Check that the section is big
a094f6
            enough for the entire reloc.
a094f6
            (bfd_generic_get_relocated_section_contents): Report unexpected
a094f6
            return values from perform_reloc.
a094f6
a094f6
### a/bfd/ChangeLog
a094f6
### b/bfd/ChangeLog
a094f6
## -1,5 +1,31 @@
a094f6
 2015-01-15  Nick Clifton  <nickc@redhat.com>
a094f6
 
a094f6
+	PR binutils/17512
a094f6
+	* elf-m10300.c (mn10300_info_to_howto): Replace assertion with an
a094f6
+	error message.  Never return an invalid howto pointer.
a094f6
+	* elf32-cr16.c (cr16_info_to_howto): Likewise.
a094f6
+	* elf32-crx.c (elf_crx_info_to_howto): Likewise.
a094f6
+	* elf32-i370.c (i370_elf_info_to_howto): Likewise.
a094f6
+	* elf32-mcore.c (mcore_elf_info_to_howto): Likewise.
a094f6
+	* elf32-microblaze.c (microblaze_elf_info_to_howto): Likewise.
a094f6
+	* elf32-mips.c (mips_elf32_rtype_to_howto): Likewise.
a094f6
+	* elf32-pj.c (pj_elf_info_to_howto): Likewise.
a094f6
+	* elf32-ppc.c (ppc_elf_info_to_howto): Likewise.
a094f6
+	* elf32-spu.c (spu_elf_info_to_howto): Likewise.
a094f6
+	* elf32-v850.c (v850_elf_info_to_howto_rela): Likewise.
a094f6
+	* elf32-vax.c (rtype_to_howto): Likewise.
a094f6
+	* elf64-alpha.c (elf64_alpha_info_to_howto): Likewise.
a094f6
+	* elf64-mips.c (mips_elf64_rtype_to_howto): Likewise.
a094f6
+	* elfn32-mips.c (sh_elf_info_to_howto): Likewise.
a094f6
+	* elf32-sh.c (sh_elf_info_to_howto): Likewise.
a094f6
+	(sh_elf_reloc): Check that the reloc is in range.
a094f6
+	* reloc.c (bfd_perform_relocation): Check that the section is big
a094f6
+	enough for the entire reloc.
a094f6
+	(bfd_generic_get_relocated_section_contents): Report unexpected
a094f6
+	return values from perform_reloc.
a094f6
+
a094f6
+2015-01-15  Nick Clifton  <nickc@redhat.com>
a094f6
+
a094f6
 	* elf32-msp430.c (msp430_elf_relax_section): Skip unhandled
a094f6
 	relocs.  Include PC-relative adjustment for R_MSP430X_ABS16
a094f6
 	relaxation.
a094f6
--- a/bfd/elf-m10300.c
a094f6
+++ b/bfd/elf-m10300.c
a094f6
@@ -806,7 +806,13 @@ mn10300_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
   unsigned int r_type;
a094f6
 
a094f6
   r_type = ELF32_R_TYPE (dst->r_info);
a094f6
-  BFD_ASSERT (r_type < (unsigned int) R_MN10300_MAX);
a094f6
+  if (r_type >= R_MN10300_MAX)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised MN10300 reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_MN10300_NONE;
a094f6
+    }
a094f6
   cache_ptr->howto = elf_mn10300_howto_table + r_type;
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf32-cr16.c
a094f6
+++ b/bfd/elf32-cr16.c
a094f6
@@ -673,7 +673,13 @@ elf_cr16_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED, arelent *cache_ptr,
a094f6
 {
a094f6
   unsigned int r_type = ELF32_R_TYPE (dst->r_info);
a094f6
 
a094f6
-  BFD_ASSERT (r_type < (unsigned int) R_CR16_MAX);
a094f6
+  if (r_type >= R_CR16_MAX)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised CR16 reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_CR16_NONE;
a094f6
+    }
a094f6
   cache_ptr->howto = cr16_elf_howto_table + r_type;
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf32-crx.c
a094f6
+++ b/bfd/elf32-crx.c
a094f6
@@ -423,7 +423,13 @@ elf_crx_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED, arelent *cache_ptr,
a094f6
 		       Elf_Internal_Rela *dst)
a094f6
 {
a094f6
   unsigned int r_type = ELF32_R_TYPE (dst->r_info);
a094f6
-  BFD_ASSERT (r_type < (unsigned int) R_CRX_MAX);
a094f6
+  if (r_type >= R_CRX_MAX)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised CRX reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_CRX_NONE;
a094f6
+    }
a094f6
   cache_ptr->howto = &crx_elf_howto_table[r_type];
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf32-i370.c
a094f6
+++ b/bfd/elf32-i370.c
a094f6
@@ -294,12 +294,21 @@ i370_elf_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
 			arelent *cache_ptr,
a094f6
 			Elf_Internal_Rela *dst)
a094f6
 {
a094f6
+  unsigned int r_type;
a094f6
+
a094f6
   if (!i370_elf_howto_table[ R_I370_ADDR31 ])
a094f6
     /* Initialize howto table.  */
a094f6
     i370_elf_howto_init ();
a094f6
 
a094f6
-  BFD_ASSERT (ELF32_R_TYPE (dst->r_info) < (unsigned int) R_I370_max);
a094f6
-  cache_ptr->howto = i370_elf_howto_table[ELF32_R_TYPE (dst->r_info)];
a094f6
+  r_type = ELF32_R_TYPE (dst->r_info);
a094f6
+  if (r_type >= R_I370_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised I370 reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_I370_NONE;
a094f6
+    }
a094f6
+  cache_ptr->howto = i370_elf_howto_table[r_type];
a094f6
 }
a094f6
 
a094f6
 /* Hack alert --  the following several routines look generic to me ...
a094f6
--- a/bfd/elf32-mcore.c
a094f6
+++ b/bfd/elf32-mcore.c
a094f6
@@ -340,13 +340,22 @@ mcore_elf_info_to_howto (bfd * abfd ATTRIBUTE_UNUSED,
a094f6
 			 arelent * cache_ptr,
a094f6
 			 Elf_Internal_Rela * dst)
a094f6
 {
a094f6
+  unsigned int r_type;
a094f6
+
a094f6
   if (! mcore_elf_howto_table [R_MCORE_PCRELIMM8BY4])
a094f6
     /* Initialize howto table if needed.  */
a094f6
     mcore_elf_howto_init ();
a094f6
 
a094f6
-  BFD_ASSERT (ELF32_R_TYPE (dst->r_info) < (unsigned int) R_MCORE_max);
a094f6
+  r_type = ELF32_R_TYPE (dst->r_info);
a094f6
+  if (r_type >= R_MCORE_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised MCore reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_MCORE_NONE;
a094f6
+    }
a094f6
 
a094f6
-  cache_ptr->howto = mcore_elf_howto_table [ELF32_R_TYPE (dst->r_info)];
a094f6
+  cache_ptr->howto = mcore_elf_howto_table [r_type];
a094f6
 }
a094f6
 
a094f6
 /* The RELOCATE_SECTION function is called by the ELF backend linker
a094f6
--- a/bfd/elf32-microblaze.c
a094f6
+++ b/bfd/elf32-microblaze.c
a094f6
@@ -643,13 +643,22 @@ microblaze_elf_info_to_howto (bfd * abfd ATTRIBUTE_UNUSED,
a094f6
 			      arelent * cache_ptr,
a094f6
 			      Elf_Internal_Rela * dst)
a094f6
 {
a094f6
+  unsigned int r_type;
a094f6
+
a094f6
   if (!microblaze_elf_howto_table [R_MICROBLAZE_32])
a094f6
     /* Initialize howto table if needed.  */
a094f6
     microblaze_elf_howto_init ();
a094f6
 
a094f6
-  BFD_ASSERT (ELF32_R_TYPE (dst->r_info) < (unsigned int) R_MICROBLAZE_max);
a094f6
+  r_type = ELF32_R_TYPE (dst->r_info);
a094f6
+  if (r_type >= R_MICROBLAZE_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised MicroBlaze reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_MICROBLAZE_NONE;
a094f6
+    }
a094f6
 
a094f6
-  cache_ptr->howto = microblaze_elf_howto_table [ELF32_R_TYPE (dst->r_info)];
a094f6
+  cache_ptr->howto = microblaze_elf_howto_table [r_type];
a094f6
 }
a094f6
 
a094f6
 /* Microblaze ELF local labels start with 'L.' or '$L', not '.L'.  */
a094f6
--- a/bfd/elf32-mips.c
a094f6
+++ b/bfd/elf32-mips.c
a094f6
@@ -2204,7 +2204,12 @@ mips_elf32_rtype_to_howto (unsigned int r_type,
a094f6
 	return &elf_micromips_howto_table_rel[r_type - R_MICROMIPS_min];
a094f6
       if (r_type >= R_MIPS16_min && r_type < R_MIPS16_max)
a094f6
         return &elf_mips16_howto_table_rel[r_type - R_MIPS16_min];
a094f6
-      BFD_ASSERT (r_type < (unsigned int) R_MIPS_max);
a094f6
+      if (r_type >= (unsigned int) R_MIPS_max)
a094f6
+	{
a094f6
+	  (*_bfd_error_handler) (_("Unrecognised MIPS reloc number: %d"), r_type);
a094f6
+	  bfd_set_error (bfd_error_bad_value);
a094f6
+	  r_type = R_MIPS_NONE;
a094f6
+	}
a094f6
       return &elf_mips_howto_table_rel[r_type];
a094f6
     }
a094f6
 }
a094f6
--- a/bfd/elf32-pj.c
a094f6
+++ b/bfd/elf32-pj.c
a094f6
@@ -319,7 +319,13 @@ pj_elf_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
 
a094f6
   r = ELF32_R_TYPE (dst->r_info);
a094f6
 
a094f6
-  BFD_ASSERT (r < (unsigned int) R_PJ_max);
a094f6
+  if (r >= R_PJ_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised PicoJava reloc number: %d"),
a094f6
+			     abfd, r);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r = R_PJ_NONE;
a094f6
+    }
a094f6
 
a094f6
   cache_ptr->howto = &pj_elf_howto_table[r];
a094f6
 }
a094f6
--- a/bfd/elf32-ppc.c
a094f6
+++ b/bfd/elf32-ppc.c
a094f6
@@ -2019,19 +2019,28 @@ ppc_elf_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
 		       arelent *cache_ptr,
a094f6
 		       Elf_Internal_Rela *dst)
a094f6
 {
a094f6
+  unsigned int r_type;
a094f6
+
a094f6
   /* Initialize howto table if not already done.  */
a094f6
   if (!ppc_elf_howto_table[R_PPC_ADDR32])
a094f6
     ppc_elf_howto_init ();
a094f6
 
a094f6
-  BFD_ASSERT (ELF32_R_TYPE (dst->r_info) < (unsigned int) R_PPC_max);
a094f6
-  cache_ptr->howto = ppc_elf_howto_table[ELF32_R_TYPE (dst->r_info)];
a094f6
+  r_type = ELF32_R_TYPE (dst->r_info);
a094f6
+  if (r_type >= R_PPC_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised PPC reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_PPC_NONE;
a094f6
+    }
a094f6
+  cache_ptr->howto = ppc_elf_howto_table[r_type];
a094f6
 
a094f6
   /* Just because the above assert didn't trigger doesn't mean that
a094f6
      ELF32_R_TYPE (dst->r_info) is necessarily a valid relocation.  */
a094f6
   if (!cache_ptr->howto)
a094f6
     {
a094f6
       (*_bfd_error_handler) (_("%B: invalid relocation type %d"),
a094f6
-                             abfd, ELF32_R_TYPE (dst->r_info));
a094f6
+                             abfd, r_type);
a094f6
       bfd_set_error (bfd_error_bad_value);
a094f6
 
a094f6
       cache_ptr->howto = ppc_elf_howto_table[R_PPC_NONE];
a094f6
--- a/bfd/elf32-sh.c
a094f6
+++ b/bfd/elf32-sh.c
a094f6
@@ -255,6 +255,13 @@ sh_elf_reloc (bfd *abfd, arelent *reloc_entry, asymbol *symbol_in,
a094f6
       && bfd_is_und_section (symbol_in->section))
a094f6
     return bfd_reloc_undefined;
a094f6
 
a094f6
+  /* PR 17512: file: 9891ca98.  */
a094f6
+  if (addr > bfd_get_section_limit (abfd, input_section)
a094f6
+      - bfd_get_reloc_size (reloc_entry->howto)
a094f6
+      || bfd_get_reloc_size (reloc_entry->howto)
a094f6
+      > bfd_get_section_limit (abfd, input_section))
a094f6
+    return bfd_reloc_outofrange;
a094f6
+
a094f6
   if (bfd_is_com_section (symbol_in->section))
a094f6
     sym_value = 0;
a094f6
   else
a094f6
@@ -474,13 +481,19 @@ sh_elf_info_to_howto (bfd *abfd, arelent *cache_ptr, Elf_Internal_Rela *dst)
a094f6
 
a094f6
   r = ELF32_R_TYPE (dst->r_info);
a094f6
 
a094f6
-  BFD_ASSERT (r < (unsigned int) R_SH_max);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC || r > R_SH_LAST_INVALID_RELOC);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC_2 || r > R_SH_LAST_INVALID_RELOC_2);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC_3 || r > R_SH_LAST_INVALID_RELOC_3);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC_4 || r > R_SH_LAST_INVALID_RELOC_4);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC_5 || r > R_SH_LAST_INVALID_RELOC_5);
a094f6
-  BFD_ASSERT (r < R_SH_FIRST_INVALID_RELOC_6 || r > R_SH_LAST_INVALID_RELOC_6);
a094f6
+  if (r >= R_SH_max
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC   && r <= R_SH_LAST_INVALID_RELOC)
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC_2 && r <= R_SH_LAST_INVALID_RELOC_2)
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC_3 && r <= R_SH_LAST_INVALID_RELOC_3)
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC_4 && r <= R_SH_LAST_INVALID_RELOC_4)
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC_5 && r <= R_SH_LAST_INVALID_RELOC_5)
a094f6
+      || (r >= R_SH_FIRST_INVALID_RELOC_6 && r <= R_SH_LAST_INVALID_RELOC_6))
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised SH reloc number: %d"),
a094f6
+			     abfd, r);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r = R_SH_NONE;
a094f6
+    }
a094f6
 
a094f6
   cache_ptr->howto = get_howto_table (abfd) + r;
a094f6
 }
a094f6
--- a/bfd/elf32-spu.c
a094f6
+++ b/bfd/elf32-spu.c
a094f6
@@ -151,7 +151,14 @@ spu_elf_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
   enum elf_spu_reloc_type r_type;
a094f6
 
a094f6
   r_type = (enum elf_spu_reloc_type) ELF32_R_TYPE (dst->r_info);
a094f6
-  BFD_ASSERT (r_type < R_SPU_max);
a094f6
+  /* PR 17512: file: 90c2a92e.  */
a094f6
+  if (r_type >= R_SPU_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised SPU reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_SPU_NONE;
a094f6
+    }
a094f6
   cache_ptr->howto = &elf_howto_table[(int) r_type];
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf32-v850.c
a094f6
+++ b/bfd/elf32-v850.c
a094f6
@@ -1914,7 +1914,11 @@ v850_elf_info_to_howto_rela (bfd *abfd ATTRIBUTE_UNUSED,
a094f6
   unsigned int r_type;
a094f6
 
a094f6
   r_type = ELF32_R_TYPE (dst->r_info);
a094f6
-  BFD_ASSERT (r_type < (unsigned int) R_V850_max);
a094f6
+  if (r_type >= (unsigned int) R_V850_max)
a094f6
+    {
a094f6
+      _bfd_error_handler (_("%A: invalid V850 reloc number: %d"), abfd, r_type);
a094f6
+      r_type = 0;
a094f6
+    }
a094f6
   cache_ptr->howto = &v850_elf_howto_table[r_type];
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf32-vax.c
a094f6
+++ b/bfd/elf32-vax.c
a094f6
@@ -283,8 +283,17 @@ static void
a094f6
 rtype_to_howto (bfd *abfd ATTRIBUTE_UNUSED, arelent *cache_ptr,
a094f6
 		Elf_Internal_Rela *dst)
a094f6
 {
a094f6
-  BFD_ASSERT (ELF32_R_TYPE(dst->r_info) < (unsigned int) R_VAX_max);
a094f6
-  cache_ptr->howto = &howto_table[ELF32_R_TYPE(dst->r_info)];
a094f6
+  unsigned int r_type;
a094f6
+
a094f6
+  r_type = ELF32_R_TYPE (dst->r_info);
a094f6
+  if (r_type >= R_VAX_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised VAX reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_VAX_NONE;
a094f6
+    }
a094f6
+  cache_ptr->howto = &howto_table[r_type];
a094f6
 }
a094f6
 
a094f6
 #define elf_info_to_howto rtype_to_howto
a094f6
--- a/bfd/elf64-alpha.c
a094f6
+++ b/bfd/elf64-alpha.c
a094f6
@@ -1105,7 +1105,14 @@ elf64_alpha_info_to_howto (bfd *abfd ATTRIBUTE_UNUSED, arelent *cache_ptr,
a094f6
 			   Elf_Internal_Rela *dst)
a094f6
 {
a094f6
   unsigned r_type = ELF64_R_TYPE(dst->r_info);
a094f6
-  BFD_ASSERT (r_type < (unsigned int) R_ALPHA_max);
a094f6
+
a094f6
+  if (r_type >= R_ALPHA_max)
a094f6
+    {
a094f6
+      (*_bfd_error_handler) (_("%A: unrecognised Alpha reloc number: %d"),
a094f6
+			     abfd, r_type);
a094f6
+      bfd_set_error (bfd_error_bad_value);
a094f6
+      r_type = R_ALPHA_NONE;
a094f6
+    }
a094f6
   cache_ptr->howto = &elf64_alpha_howto_table[r_type];
a094f6
 }
a094f6
 
a094f6
--- a/bfd/elf64-mips.c
a094f6
+++ b/bfd/elf64-mips.c
a094f6
@@ -3585,7 +3585,12 @@ mips_elf64_rtype_to_howto (unsigned int r_type, bfd_boolean rela_p)
a094f6
 	  else
a094f6
 	    return &mips16_elf64_howto_table_rel[r_type - R_MIPS16_min];
a094f6
 	}
a094f6
-      BFD_ASSERT (r_type < (unsigned int) R_MIPS_max);
a094f6
+      if (r_type >= R_MIPS_max)
a094f6
+	{
a094f6
+	  (*_bfd_error_handler) (_("unrecognised MIPS reloc number: %d"), r_type);
a094f6
+	  bfd_set_error (bfd_error_bad_value);
a094f6
+	  r_type = R_MIPS_NONE;
a094f6
+	}
a094f6
       if (rela_p)
a094f6
 	return &mips_elf64_howto_table_rela[r_type];
a094f6
       else
a094f6
--- a/bfd/elfn32-mips.c
a094f6
+++ b/bfd/elfn32-mips.c
a094f6
@@ -3403,7 +3403,12 @@ mips_elf_n32_rtype_to_howto (unsigned int r_type, bfd_boolean rela_p)
a094f6
 	  else
a094f6
 	    return &elf_mips16_howto_table_rel[r_type - R_MIPS16_min];
a094f6
 	}
a094f6
-      BFD_ASSERT (r_type < (unsigned int) R_MIPS_max);
a094f6
+      if (r_type >= R_MIPS_max)
a094f6
+	{
a094f6
+	  (*_bfd_error_handler) (_("unrecognised MIPS reloc number: %d"), r_type);
a094f6
+	  bfd_set_error (bfd_error_bad_value);
a094f6
+	  r_type = R_MIPS_NONE;
a094f6
+	}
a094f6
       if (rela_p)
a094f6
 	return &elf_mips_howto_table_rela[r_type];
a094f6
       else
a094f6
--- a/bfd/reloc.c
a094f6
+++ b/bfd/reloc.c
a094f6
@@ -623,7 +623,10 @@ bfd_perform_relocation (bfd *abfd,
a094f6
       /* PR 17512: file: c146ab8b.
a094f6
 	 PR 17512: file: 46dff27f.
a094f6
 	 Include the size of the reloc in the test for out of range addresses.  */
a094f6
-      - bfd_get_reloc_size (howto))
a094f6
+      - bfd_get_reloc_size (howto)
a094f6
+      /* PR 17512: file: 38e53ebf
a094f6
+	 Add make sure that there is enough room for the relocation to be applied.  */
a094f6
+      || bfd_get_reloc_size (howto) > bfd_get_section_limit (abfd, input_section))
a094f6
     return bfd_reloc_outofrange;
a094f6
 
a094f6
   /* Work out which section the relocation is targeted at and the
a094f6
@@ -7691,7 +7694,11 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
a094f6
 		  goto error_return;
a094f6
 
a094f6
 		default:
a094f6
-		  abort ();
a094f6
+		  /* PR 17512; file: 90c2a92e.
a094f6
+		     Report unexpected results, without aborting.  */
a094f6
+		  link_info->callbacks->einfo
a094f6
+		    (_("%X%P: %B(%A): relocation \"%R\" returns an unrecognized value %x\n"),
a094f6
+		     abfd, input_section, * parent, r);
a094f6
 		  break;
a094f6
 		}
a094f6