From: Alan Modra <amodra@gmail.com>
Date: Mon, 1 Feb 2016 10:57:02 +0000 (+1030)
Subject: x86 synthetic plt symbols
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=ec1f73bb0be7482f2dffd9bbca2f93fc74eca172;p=binutils-gdb.git

x86 synthetic plt symbols

Changing "pushq $1" in the following to "pushq $too_big" results in an
abort.  BFD shouldn't abort on (deliberately) bad user input.

 400480:       ff 25 9a 0b 20 00       jmpq   *0x200b9a(%rip)
 400486:       68 01 00 00 00          pushq  $0x1
 40048b:       e9 d0 ff ff ff          jmpq   400460 <_init+0x20>

	* elf64-x86-64.c (elf_x86_64_get_plt_sym_val): Don't abort on
	an out of range reloc_index.
	* elf32-i386.c (elf_i386_get_plt_sym_val): Likewise.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 8648c5011a6..f75631e54aa 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2016-02-01  Alan Modra  <amodra@gmail.com>
+
+	* elf64-x86-64.c (elf_x86_64_get_plt_sym_val): Don't abort on
+	an out of range reloc_index.
+	* elf32-i386.c (elf_i386_get_plt_sym_val): Likewise.
+
 2016-02-01  Kamil Rytarowski  <n54@gmx.com>
 
 	* Makefile.am (OPTIONAL_BACKENDS): Add netbsd-core.lo.
diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c
index 81a95e0cf29..ccd013533d8 100644
--- a/bfd/elf32-i386.c
+++ b/bfd/elf32-i386.c
@@ -5684,9 +5684,9 @@ bad_return:
       reloc_index = H_GET_32 (abfd, (plt_contents + plt_offset
 				     + bed->plt->plt_reloc_offset));
       reloc_index /= sizeof (Elf32_External_Rel);
-      if (reloc_index >= count)
-	abort ();
-      plt_sym_val[reloc_index] = plt->vma + plt_offset;
+      if (reloc_index < count)
+	plt_sym_val[reloc_index] = plt->vma + plt_offset;
+
       plt_offset += bed->plt->plt_entry_size;
 
       /* PR binutils/18437: Skip extra relocations in the .rel.plt
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
index 37528beed43..88ed00e2d16 100644
--- a/bfd/elf64-x86-64.c
+++ b/bfd/elf64-x86-64.c
@@ -6066,19 +6066,20 @@ bad_return:
 
       reloc_index = H_GET_32 (abfd, (plt_contents + plt_offset
 				     + bed->plt_reloc_offset));
-      if (reloc_index >= count)
-	abort ();
-      if (plt_bnd)
+      if (reloc_index < count)
 	{
-	  /* This is the index in .plt section.  */
-	  long plt_index = plt_offset / bed->plt_entry_size;
-	  /* Store VMA + the offset in .plt.bnd section.  */
-	  plt_sym_val[reloc_index] =
-	    (plt_bnd->vma
-	     + (plt_index - 1) * sizeof (elf_x86_64_legacy_plt2_entry));
+	  if (plt_bnd)
+	    {
+	      /* This is the index in .plt section.  */
+	      long plt_index = plt_offset / bed->plt_entry_size;
+	      /* Store VMA + the offset in .plt.bnd section.  */
+	      plt_sym_val[reloc_index] =
+		(plt_bnd->vma
+		 + (plt_index - 1) * sizeof (elf_x86_64_legacy_plt2_entry));
+	    }
+	  else
+	    plt_sym_val[reloc_index] = plt->vma + plt_offset;
 	}
-      else
-	plt_sym_val[reloc_index] = plt->vma + plt_offset;
       plt_offset += bed->plt_entry_size;
 
       /* PR binutils/18437: Skip extra relocations in the .rela.plt