PR22509 - Null pointer dereference on coff_slurp_reloc_table

This extends the commit 4581a1c7d304 fix to more targets, which
hardens BFD a little.  I think the real underlying problem was the
bfd_canonicalize_reloc call in load_specific_debug_section which
passed a NULL for "symbols".  Fix that too.

	PR 22509
bfd/
	* aoutx.h (swap_ext_reloc_out): Gracefully handle NULL symbols.
	* i386lynx.c (swap_ext_reloc_out): Likewise.
	* pdp11.c (pdp11_aout_swap_reloc_out): Likewise.
	* coff-tic30.c (reloc_processing): Likewise.
	* coff-tic4x.c (tic4x_reloc_processing): Likewise.
	* coff-tic54x.c (tic54x_reloc_processing): Likewise.
	* coff-z80.c (reloc_processing): Likewise.
	* coff-z8k.c (reloc_processing): Likewise.
	* ecoff.c (ecoff_slurp_reloc_table): Likewise.
	* som.c (som_set_reloc_info): Likewise.
binutils/
	* objdump.c (load_specific_debug_section): Pass syms to
	bfd_canonicalize_reloc.

diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index 61ea9f7ce047da2bb05dfb5f7bf0d30a064eb4aa..38e304315892fd3b21ac92f2680edd512887b23f 100644 (file)
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -2122,8 +2122,10 @@ NAME (aout, swap_ext_reloc_out) (bfd *abfd,
   if (r_extern)                                                                \
     {                                                                  \
       /* Undefined symbol.  */                                         \
-      if (r_index < bfd_get_symcount (abfd))                           \
+      if (symbols != NULL && r_index < bfd_get_symcount (abfd))                \
        cache_ptr->sym_ptr_ptr = symbols + r_index;                     \
+      else                                                             \
+       cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;   \
       cache_ptr->addend = ad;                                          \
     }                                                                  \
    else                                                                        \

diff --git a/bfd/coff-tic30.c b/bfd/coff-tic30.c
index 874fd79f3fa330aafdfe3d59df21ed9e33907828..fcc85754068e5ba9e256bdf7f5e3059fd65c5886 100644 (file)
--- a/bfd/coff-tic30.c
+++ b/bfd/coff-tic30.c
@@ -161,7 +161,7 @@ reloc_processing (arelent *relent,
   relent->address = reloc->r_vaddr;
   rtype2howto (relent, reloc);
 
-  if (reloc->r_symndx == -1)
+  if (reloc->r_symndx == -1 || symbols == NULL)
     relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
   else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
     relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

diff --git a/bfd/coff-tic4x.c b/bfd/coff-tic4x.c
index 02013e1655fbb3a1fbb10bb785424b545dd60675..be295259915e2a74bc22048df0d8682fd9a2d0ef 100644 (file)
--- a/bfd/coff-tic4x.c
+++ b/bfd/coff-tic4x.c
@@ -219,7 +219,7 @@ tic4x_reloc_processing (arelent *relent,
 
   relent->address = reloc->r_vaddr;
 
-  if (reloc->r_symndx != -1)
+  if (reloc->r_symndx != -1 && symbols != NULL)
     {
       if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
        {

diff --git a/bfd/coff-tic54x.c b/bfd/coff-tic54x.c
index 8b4935845039a5ec7a0894e99a6bd26e367735d2..9ec4b2064c3f44ab9ea9ee9cff6c76641a14d443 100644 (file)
--- a/bfd/coff-tic54x.c
+++ b/bfd/coff-tic54x.c
@@ -357,7 +357,7 @@ tic54x_reloc_processing (arelent *relent,
 
   relent->address = reloc->r_vaddr;
 
-  if (reloc->r_symndx != -1)
+  if (reloc->r_symndx != -1 && symbols != NULL)
     {
       if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
        {

diff --git a/bfd/coff-z80.c b/bfd/coff-z80.c
index ba0f2609bf07ef508488e35d28b8f3a3f1d71340..7fb2f1373318c26113b5546052526bb6b63aa966 100644 (file)
--- a/bfd/coff-z80.c
+++ b/bfd/coff-z80.c
@@ -314,7 +314,7 @@ reloc_processing (arelent *relent,
   relent->address = reloc->r_vaddr;
   rtype2howto (relent, reloc);
 
-  if (reloc->r_symndx == -1)
+  if (reloc->r_symndx == -1 || symbols == NULL)
     relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
   else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
     relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

diff --git a/bfd/coff-z8k.c b/bfd/coff-z8k.c
index b9f6f9773adc7d5baae638c68c74401d78b219b2..974bffc9a6ff551dff4e16ea986119aec7d7079a 100644 (file)
--- a/bfd/coff-z8k.c
+++ b/bfd/coff-z8k.c
@@ -177,7 +177,7 @@ reloc_processing (arelent *relent,
   relent->address = reloc->r_vaddr;
   rtype2howto (relent, reloc);
 
-  if (reloc->r_symndx == -1)
+  if (reloc->r_symndx == -1 || symbols == NULL)
     relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
   else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
     relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

diff --git a/bfd/ecoff.c b/bfd/ecoff.c
index a4edf7a2e6cb05a0fc6b6b82529d7bef4f3b07f8..2d26b855e4c5edbbc1de54bc11f9fd95986c3a6d 100644 (file)
--- a/bfd/ecoff.c
+++ b/bfd/ecoff.c
@@ -1612,7 +1612,8 @@ ecoff_slurp_reloc_table (bfd *abfd,
       if (intern.r_extern)
        {
          /* r_symndx is an index into the external symbols.  */
-         if (intern.r_symndx >= 0
+         if (symbols != NULL
+             && intern.r_symndx >= 0
              && (intern.r_symndx
                  < (ecoff_data (abfd)->debug_info.symbolic_header.iextMax)))
            rptr->sym_ptr_ptr = symbols + intern.r_symndx;

diff --git a/bfd/i386lynx.c b/bfd/i386lynx.c
index 5df3d19ffe0c2804ee382f85d5df63cb46c08e96..acc38d2443830e401526f75788ca51a532d217b7 100644 (file)
--- a/bfd/i386lynx.c
+++ b/bfd/i386lynx.c
@@ -283,8 +283,10 @@ NAME(lynx,swap_ext_reloc_out) (bfd *abfd,
   if (r_extern)                                                                \
     {                                                                  \
       /* undefined symbol */                                           \
-      if (r_index < bfd_get_symcount (abfd))                           \
+      if (symbols != NULL && r_index < bfd_get_symcount (abfd))                \
        cache_ptr->sym_ptr_ptr = symbols + r_index;                     \
+      else                                                             \
+       cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;   \
       cache_ptr->addend = ad;                                          \
     }                                                                  \
   else                                                                 \

diff --git a/bfd/pdp11.c b/bfd/pdp11.c
index de9c8690e20e15bf1042dc893e7af8c08ce21557..806e0e12a6120ef8c4bfcc07f4a0f2ea3b8b4c45 100644 (file)
--- a/bfd/pdp11.c
+++ b/bfd/pdp11.c
@@ -1861,8 +1861,10 @@ pdp11_aout_swap_reloc_out (bfd *abfd, arelent *g, bfd_byte *natptr)
   if (r_extern)                                                                \
     {                                                                  \
       /* Undefined symbol.  */                                         \
-      if (r_index < bfd_get_symcount (abfd))                           \
+      if (symbols != NULL && r_index < bfd_get_symcount (abfd))                \
        cache_ptr->sym_ptr_ptr = symbols + r_index;                     \
+      else                                                             \
+       cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;   \
       cache_ptr->addend = ad;                                          \
     }                                                                  \
   else                                                                 \

diff --git a/bfd/som.c b/bfd/som.c
index 7a5ee35f0e2556f2d2dc7816fb868a4d43d10811..3e89c937b5e311c7cd9b1e40b404328c8aca2be5 100644 (file)
--- a/bfd/som.c
+++ b/bfd/som.c
@@ -5099,7 +5099,7 @@ som_set_reloc_info (unsigned char *fixup,
            /* A symbol to use in the relocation.  Make a note
               of this if we are not just counting.  */
            case 'S':
-             if (! just_count && (unsigned int) c < symcount)
+             if (!just_count && symbols != NULL && (unsigned int) c < symcount)
                rptr->sym_ptr_ptr = &symbols[c];
              break;
            /* Argument relocation bits for a function call.  */

diff --git a/binutils/objdump.c b/binutils/objdump.c
index 61a18746fde74640431ec352e65d00376ce70d9e..9b27ce73a879edc1eb670d3388a617af4eb3549c 100644 (file)
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -4238,7 +4238,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
 
              relocs = (arelent **) xmalloc (reloc_size);
 
-             reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, NULL);
+             reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, syms);
              if (reloc_count <= 0)
                free (relocs);
              else