diff options
| author | Nick Clifton <nickc@redhat.com> | 2017-11-28 13:20:31 +0000 |
|---|---|---|
| committer | Nick Clifton <nickc@redhat.com> | 2017-11-28 13:20:31 +0000 |
| commit | b23dc97fe237a1d9e850d7cbeee066183a00630b (patch) | |
| tree | 20c22c6c0f5c79582c14669cbe3f34fe0304f210 /bfd/coff-x86_64.c | |
| parent | 6c6bc899302deb7c9b14f71da79c0fffc992204e (diff) | |
Fix a memory access violation when attempting to parse a corrupt COFF binary with a relocation that points beyond the end of the section to be relocated.
PR 22506
* reloc.c (reloc_offset_in_range): Rename to
bfd_reloc_offset_in_range and export.
(bfd_perform_relocation): Rename function invocation.
(bfd_install_relocation): Likewise.
(bfd_final_link_relocate): Likewise.
* bfd-in2.h: Regenerate.
* coff-arm.c (coff_arm_reloc): Use bfd_reloc_offset_in_range.
* coff-i386.c (coff_i386_reloc): Likewise.
* coff-i860.c (coff_i860_reloc): Likewise.
* coff-m68k.c (mk68kcoff_common_addend_special_fn): Likewise.
* coff-m88k.c (m88k_special_reloc): Likewise.
* coff-mips.c (mips_reflo_reloc): Likewise.
* coff-x86_64.c (coff_amd64_reloc): Likewise.
Diffstat (limited to 'bfd/coff-x86_64.c')
| -rw-r--r-- | bfd/coff-x86_64.c | 16 |
1 files changed, 5 insertions, 11 deletions
diff --git a/bfd/coff-x86_64.c b/bfd/coff-x86_64.c index de22822e7b..4d0bf1835f 100644 --- a/bfd/coff-x86_64.c +++ b/bfd/coff-x86_64.c @@ -142,17 +142,11 @@ coff_amd64_reloc (bfd *abfd, { reloc_howto_type *howto = reloc_entry->howto; unsigned char *addr = (unsigned char *) data + reloc_entry->address; - - /* FIXME: We do not have an end address for data, so we cannot - accurately range check any addresses computed against it. - cf: PR binutils/17512: file: 1085-1761-0.004. - For now we do the best that we can. */ - if (addr < (unsigned char *) data - || addr > ((unsigned char *) data) + input_section->size) - { - bfd_set_error (bfd_error_bad_value); - return bfd_reloc_notsupported; - } + + if (! bfd_reloc_offset_in_range (howto, abfd, input_section, + reloc_entry->address + * bfd_octets_per_byte (abfd))) + return bfd_reloc_outofrange; switch (howto->size) { |