From ec93045b400ec68b0c5716d75f27a87533b57058 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Tue, 6 Jan 2015 17:54:02 +0000 Subject: [PATCH] Fix memory access violations for objdump triggered by fuzzed binaries. PR binutils/17512 * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1. (bfd_perform_relocation): Include the size of the reloc in the test for an out of range relocation. (bfd_generic_get_relocated_section_contents): Remove reloc range test. --- bfd/ChangeLog | 6 ++++++ bfd/reloc.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index efcb63ab312..383cf299f9e 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,6 +1,12 @@ 2015-01-06 Nick Clifton PR binutils/17512 + * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1. + (bfd_perform_relocation): Include the size of the reloc in the + test for an out of range relocation. + (bfd_generic_get_relocated_section_contents): Remove reloc range + test. + * coff-i860.c (CALC_ADDEND): Always set an addend value. * tekhex.c (getvalue): Add an end pointer parameter. Use it to avoid reading off the end of the buffer. diff --git a/bfd/reloc.c b/bfd/reloc.c index fe7d8be477e..41676081056 100644 --- a/bfd/reloc.c +++ b/bfd/reloc.c @@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto) case 3: return 0; case 4: return 8; case 8: return 16; + case -1: return 2; case -2: return 4; default: abort (); } @@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd, } /* Is the address of the relocation really within the section? */ - if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) + if (reloc_entry->address > bfd_get_section_limit (abfd, input_section) + /* PR 17512: file: c146ab8b. + PR 17512: file: 46dff27f. + Include the size of the reloc in the test for out of range addresses. */ + - bfd_get_reloc_size (howto)) return bfd_reloc_outofrange; /* Work out which section the relocation is targeted at and the @@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd, (*parent)->howto = &none_howto; r = bfd_reloc_ok; } - /* PR 17512: file: c146ab8b. */ - else if ((*parent)->address * bfd_octets_per_byte (abfd) - >= bfd_get_section_size (input_section)) - r = bfd_reloc_outofrange; else r = bfd_perform_relocation (input_bfd, *parent, -- 2.30.2