From: Nick Clifton <nickc@redhat.com>
Date: Tue, 6 Jan 2015 17:54:02 +0000 (+0000)
Subject: Fix memory access violations for objdump triggered by fuzzed binaries.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=ec93045b;p=binutils-gdb.git

Fix memory access violations for objdump triggered by fuzzed binaries.

	PR binutils/17512
	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
	(bfd_perform_relocation): Include the size of the reloc in the
	test for an out of range relocation.
	(bfd_generic_get_relocated_section_contents): Remove reloc range
	test.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index efcb63ab312..383cf299f9e 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,6 +1,12 @@
 2015-01-06  Nick Clifton  <nickc@redhat.com>
 
 	PR binutils/17512
+	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
+	(bfd_perform_relocation): Include the size of the reloc in the
+	test for an out of range relocation.
+	(bfd_generic_get_relocated_section_contents): Remove reloc range
+	test.
+
 	* coff-i860.c (CALC_ADDEND): Always set an addend value.
 	* tekhex.c (getvalue): Add an end pointer parameter.  Use it to
 	avoid reading off the end of the buffer.
diff --git a/bfd/reloc.c b/bfd/reloc.c
index fe7d8be477e..41676081056 100644
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
     case 3: return 0;
     case 4: return 8;
     case 8: return 16;
+    case -1: return 2;
     case -2: return 4;
     default: abort ();
     }
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
     }
 
   /* Is the address of the relocation really within the section?  */
-  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
+  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
+      /* PR 17512: file: c146ab8b.
+	 PR 17512: file: 46dff27f.
+	 Include the size of the reloc in the test for out of range addresses.  */
+      - bfd_get_reloc_size (howto))
     return bfd_reloc_outofrange;
 
   /* Work out which section the relocation is targeted at and the
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
 	      (*parent)->howto = &none_howto;
 	      r = bfd_reloc_ok;
 	    }
-	  /* PR 17512: file: c146ab8b.  */
-	  else if ((*parent)->address * bfd_octets_per_byte (abfd)
-		   >= bfd_get_section_size (input_section))
-	    r = bfd_reloc_outofrange;
 	  else
 	    r = bfd_perform_relocation (input_bfd,
 					*parent,