PR24336, buffer overflow in swap_reloca_in

Message ID 20190315093310.GL20126@bubble.grove.modra.org
State New
Headers show
Series
  • PR24336, buffer overflow in swap_reloca_in
Related show

Commit Message

Alan Modra March 15, 2019, 9:33 a.m.
PR 24336
	* elflink.c (elf_link_read_relocs_from_section): Handle fuzzed
	object files with sh_size not a multiple of sh_entsize.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/bfd/elflink.c b/bfd/elflink.c
index 3413726b94..2600c3934b 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -2523,9 +2523,11 @@  elf_link_read_relocs_from_section (bfd *abfd,
     }
 
   erela = (const bfd_byte *) external_relocs;
-  erelaend = erela + shdr->sh_size;
+  /* Setting erelaend like this and comparing with <= handles case of
+     a fuzzed object with sh_size not a multiple of sh_entsize.  */
+  erelaend = erela + shdr->sh_size - shdr->sh_entsize;
   irela = internal_relocs;
-  while (erela < erelaend)
+  while (erela <= erelaend)
     {
       bfd_vma r_symndx;