darkkirb/old-cross-binutils
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix memory access violations for objdump triggered by fuzzed binaries.

Browse source 
PR binutils/17512
	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
	(bfd_perform_relocation): Include the size of the reloc in the
	test for an out of range relocation.
	(bfd_generic_get_relocated_section_contents): Remove reloc range
	test.
This commit is contained in:
Nick Clifton 2015-01-06 17:54:02 +00:00
parent 60ebc25751
commit ec93045b40
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bfd/ChangeLog
View file

@ -1,6 +1,12 @@
2015-01-06 Nick Clifton <nickc@redhat.com>
PR binutils/17512
* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
(bfd_perform_relocation): Include the size of the reloc in the
test for an out of range relocation.
(bfd_generic_get_relocated_section_contents): Remove reloc range
test.
* coff-i860.c (CALC_ADDEND): Always set an addend value.
* tekhex.c (getvalue): Add an end pointer parameter. Use it to
avoid reading off the end of the buffer.

11
bfd/reloc.c
View file

@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
case 3: return 0;
case 4: return 8;
case 8: return 16;
case -1: return 2;
case -2: return 4;
default: abort ();
}
@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
}
/* Is the address of the relocation really within the section? */
if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
/* PR 17512: file: c146ab8b.
PR 17512: file: 46dff27f.
Include the size of the reloc in the test for out of range addresses. */
- bfd_get_reloc_size (howto))
return bfd_reloc_outofrange;
/* Work out which section the relocation is targeted at and the
@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
(*parent)->howto = &none_howto;
r = bfd_reloc_ok;
}
/* PR 17512: file: c146ab8b. */
else if ((*parent)->address * bfd_octets_per_byte (abfd)
>= bfd_get_section_size (input_section))
r = bfd_reloc_outofrange;
else
r = bfd_perform_relocation (input_bfd,
*parent,