PR binutils/22875: FRV/ELF: Prevent an out-of-bounds howto table access

Prevent an out-of-bounds `elf32_frv_howto_table' table access in
`frv_info_to_howto_rela' by using the size of the table rather than
R_FRV_max to determine the number of entries in the contiguous regular
FRV relocation range defined and described in the table.

	bfd/
	* elf32-frv.c (frv_info_to_howto_rela): Correct the range check
	for `elf32_frv_howto_table' table access.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index c5e0a91ab75845c06a395d848f9f2b3cd0cfb782..072ad98a7747d40d19384be3a3b8e6f175f57004 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,8 @@
+2018-04-04  Maciej W. Rozycki  <macro@mips.com>
+
+       * elf32-frv.c (frv_info_to_howto_rela): Correct the range check
+       for `elf32_frv_howto_table' table access.
+
 2018-04-04  Maciej W. Rozycki  <macro@mips.com>
 
        * elf32-mips.c (mips_elf32_rtype_to_howto): Also return

diff --git a/bfd/elf32-frv.c b/bfd/elf32-frv.c
index 7831aff806bf3b424072052378e01922bb97f646..fc0bdcde7ea2f141293c5a9063b9fd600ca698cd 100644 (file)
--- a/bfd/elf32-frv.c
+++ b/bfd/elf32-frv.c
@@ -25,6 +25,7 @@
 #include "elf/frv.h"
 #include "dwarf2.h"
 #include "hashtab.h"
+#include "libiberty.h"
 
 /* Forward declarations.  */
 
@@ -2551,7 +2552,7 @@ frv_info_to_howto_rela (bfd *abfd ATTRIBUTE_UNUSED,
       break;
 
     default:
-      if (r_type >= (unsigned int) R_FRV_max)
+      if (r_type >= ARRAY_SIZE (elf32_frv_howto_table))
        {
          /* xgettext:c-format */
          _bfd_error_handler (_("%pB: unsupported relocation type %#x"),