From: Alan Modra <amodra@gmail.com>
Date: Tue, 25 Aug 2020 05:17:50 +0000 (+0930)
Subject: PR26430, ASAN: nacl_modify_segment_map elf-nacl.c:164
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=0c1438eb15a31098ba42427e0f48e4e5cc6bfe0b;p=binutils-gdb.git

PR26430, ASAN: nacl_modify_segment_map elf-nacl.c:164

	PR 26430
	* elf-nacl.c (nacl_modify_segment_map): Correct alloc size and
	amount copied for elf_segment_map defined with one element
	sections array.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index a24957a8c19..4fc95529ab3 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,10 @@
+2020-08-25  Alan Modra  <amodra@gmail.com>
+
+	PR 26430
+	* elf-nacl.c (nacl_modify_segment_map): Correct alloc size and
+	amount copied for elf_segment_map defined with one element
+	sections array.
+
 2020-08-25  Alan Modra  <amodra@gmail.com>
 
 	PR 26422
diff --git a/bfd/elf-nacl.c b/bfd/elf-nacl.c
index 3a232dfbb0b..a7cd827c917 100644
--- a/bfd/elf-nacl.c
+++ b/bfd/elf-nacl.c
@@ -156,13 +156,13 @@ nacl_modify_segment_map (bfd *abfd, struct bfd_link_info *info)
 		  secdata->this_hdr.sh_addr = sec->vma;
 		  secdata->this_hdr.sh_size = sec->size;
 
-		  newseg = bfd_alloc (abfd,
-				      sizeof *newseg + ((seg->count + 1)
-							* sizeof (asection *)));
+		  newseg
+		    = bfd_alloc (abfd, (sizeof (*newseg)
+					+ seg->count * sizeof (asection *)));
 		  if (newseg == NULL)
 		    return FALSE;
-		  memcpy (newseg, seg,
-			  sizeof *newseg + (seg->count * sizeof (asection *)));
+		  memcpy (newseg, seg, (sizeof (*newseg) - sizeof (asection *)
+					+ seg->count * sizeof (asection *)));
 		  newseg->sections[newseg->count++] = sec;
 		  *m = seg = newseg;
 		}