PR25900, RISC-V: null pointer dereference

	PR 25900
	* elfnn-riscv.c (_bfd_riscv_relax_section): Check root.type before
	accessing root.u.def of symbols.  Also check root.u.def.section
	is non-NULL.  Reverse tests so as to make the logic positive.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 15c77bece90f61ae9aaea64d536738733b3167e5..a2b0771db27d8db4bae12d73eeca8f6404e3bc91 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,10 @@
+2020-05-01  Alan Modra  <amodra@gmail.com>
+
+       PR 25900
+       * elfnn-riscv.c (_bfd_riscv_relax_section): Check root.type before
+       accessing root.u.def of symbols.  Also check root.u.def.section
+       is non-NULL.  Reverse tests so as to make the logic positive.
+
 2020-05-01  Alan Modra  <amodra@gmail.com>
 
        PR 25882

diff --git a/bfd/elfnn-riscv.c b/bfd/elfnn-riscv.c
index 8fcb1067fd6b5332adc53c02928db7f5b6c154f4..473bf50f2de75272215e1f189c5aa0286f78ea3c 100644 (file)
--- a/bfd/elfnn-riscv.c
+++ b/bfd/elfnn-riscv.c
@@ -4161,15 +4161,16 @@ _bfd_riscv_relax_section (bfd *abfd, asection *sec,
              symval = 0;
              sym_sec = bfd_und_section_ptr;
            }
-         else if (h->root.u.def.section->output_section == NULL
-                  || (h->root.type != bfd_link_hash_defined
-                      && h->root.type != bfd_link_hash_defweak))
-           continue;
-         else
+         else if ((h->root.type == bfd_link_hash_defined
+                   || h->root.type == bfd_link_hash_defweak)
+                  && h->root.u.def.section != NULL
+                  && h->root.u.def.section->output_section != NULL)
            {
              symval = h->root.u.def.value;
              sym_sec = h->root.u.def.section;
            }
+         else
+           continue;
 
          if (h->type != STT_FUNC)
            reserve_size =