From 4538d1c7c46e67b472d8d5ebf163f3dfd9c67714 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Sun, 28 Jul 2019 14:56:37 +0930 Subject: [PATCH] PR24857, ld: error adding symbols: bad value This fixes two cases where elf_link_add_object_symbols returns an error, setting the catch-all bfd_error_bad_value without explaining the error. The second one is an internal error that can only be caused by a target elf_add_symbol_hook, so make that one abort. The first one is my PR24339 fix. PR24339 is another of those fuzzing bugs and the fix I made catches the problem when loading symbols, rather than when symbols are used in relocs. While ld is correct to reject the object file as not complying with the ELF standard, let's be a little more forgiving for dynamic objects. PR 24857 PR 24339 * elflink.c (elf_link_add_object_symbols): Report an informative error on finding local symbols with index equal or greater than symbol table sh_info. Correct comment. Allow such symbols in dynamic objects. Abort on NULL section for symbol. --- bfd/ChangeLog | 9 +++++++++ bfd/elflink.c | 20 +++++++++++++++----- 2 files changed, 24 insertions(+), 5 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 05ea634b688..13649040c08 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,12 @@ +2019-07-28 Alan Modra + + PR 24857 + PR 24339 + * elflink.c (elf_link_add_object_symbols): Report an informative + error on finding local symbols with index equal or greater than + symbol table sh_info. Correct comment. Allow such symbols in + dynamic objects. Abort on NULL section for symbol. + 2019-07-26 Alan Modra * elf-bfd.h (struct output_elf_obj_tdata): Delete "linker" field. diff --git a/bfd/elflink.c b/bfd/elflink.c index 98941cccd0d..ad146d48fc9 100644 --- a/bfd/elflink.c +++ b/bfd/elflink.c @@ -4421,6 +4421,7 @@ error_free_dyn: bfd_boolean common; bfd_boolean discarded; unsigned int old_alignment; + unsigned int shindex; bfd *old_bfd; bfd_boolean matched; @@ -4450,7 +4451,19 @@ error_free_dyn: continue; /* If we aren't prepared to handle locals within the globals - then we'll likely segfault on a NULL section. */ + then we'll likely segfault on a NULL symbol hash if the + symbol is ever referenced in relocations. */ + shindex = elf_elfheader (abfd)->e_shstrndx; + name = bfd_elf_string_from_elf_section (abfd, shindex, hdr->sh_name); + _bfd_error_handler (_("%pB: %s local symbol at index %lu" + " (>= sh_info of %lu)"), + abfd, name, (long) (isym - isymbuf + extsymoff), + (long) extsymoff); + + /* Dynamic object relocations are not processed by ld, so + ld won't run into the problem mentioned above. */ + if (dynamic) + continue; bfd_set_error (bfd_error_bad_value); goto error_free_vers; @@ -4550,10 +4563,7 @@ error_free_dyn: /* Sanity check that all possibilities were handled. */ if (sec == NULL) - { - bfd_set_error (bfd_error_bad_value); - goto error_free_vers; - } + abort (); /* Silently discard TLS symbols from --just-syms. There's no way to combine a static TLS block with a new TLS block -- 2.30.2