mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-24 12:35:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

PR22509 - Null pointer dereference on coff_slurp_reloc_table

Browse Source 
This extends the commit 4581a1c7d3 fix to more targets, which
hardens BFD a little.  I think the real underlying problem was the
bfd_canonicalize_reloc call in load_specific_debug_section which
passed a NULL for "symbols".  Fix that too.

	PR 22509
bfd/
	* aoutx.h (swap_ext_reloc_out): Gracefully handle NULL symbols.
	* i386lynx.c (swap_ext_reloc_out): Likewise.
	* pdp11.c (pdp11_aout_swap_reloc_out): Likewise.
	* coff-tic30.c (reloc_processing): Likewise.
	* coff-tic4x.c (tic4x_reloc_processing): Likewise.
	* coff-tic54x.c (tic54x_reloc_processing): Likewise.
	* coff-z80.c (reloc_processing): Likewise.
	* coff-z8k.c (reloc_processing): Likewise.
	* ecoff.c (ecoff_slurp_reloc_table): Likewise.
	* som.c (som_set_reloc_info): Likewise.
binutils/
	* objdump.c (load_specific_debug_section): Pass syms to
	bfd_canonicalize_reloc.
This commit is contained in:
Alan Modra 2022-11-23 22:12:30 +10:30
parent d499fb8944
commit e6b6fad2fe
11 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bfd/aoutx.h
View File

@ -2122,8 +2122,10 @@ NAME (aout, swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* Undefined symbol. */ \
if (r_index < bfd_get_symcount (abfd)) \
if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
else \
cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \

2
bfd/coff-tic30.c
View File

@ -161,7 +161,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
if (reloc->r_symndx == -1)
if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

2
bfd/coff-tic4x.c
View File

@ -219,7 +219,7 @@ tic4x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
if (reloc->r_symndx != -1)
if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{

2
bfd/coff-tic54x.c
View File

@ -357,7 +357,7 @@ tic54x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
if (reloc->r_symndx != -1)
if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{

2
bfd/coff-z80.c
View File

@ -314,7 +314,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
if (reloc->r_symndx == -1)
if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

2
bfd/coff-z8k.c
View File

@ -177,7 +177,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
if (reloc->r_symndx == -1)
if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];

3
bfd/ecoff.c
View File

@ -1612,7 +1612,8 @@ ecoff_slurp_reloc_table (bfd *abfd,
if (intern.r_extern)
{
/* r_symndx is an index into the external symbols. */
if (intern.r_symndx >= 0
if (symbols != NULL
&& intern.r_symndx >= 0
&& (intern.r_symndx
< (ecoff_data (abfd)->debug_info.symbolic_header.iextMax)))
rptr->sym_ptr_ptr = symbols + intern.r_symndx;

4
bfd/i386lynx.c
View File

@ -283,8 +283,10 @@ NAME(lynx,swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* undefined symbol */ \
if (r_index < bfd_get_symcount (abfd)) \
if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
else \
cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \

4
bfd/pdp11.c
View File

@ -1861,8 +1861,10 @@ pdp11_aout_swap_reloc_out (bfd *abfd, arelent *g, bfd_byte *natptr)
if (r_extern) \
{ \
/* Undefined symbol. */ \
if (r_index < bfd_get_symcount (abfd)) \
if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
else \
cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \

2
bfd/som.c
View File

@ -5099,7 +5099,7 @@ som_set_reloc_info (unsigned char *fixup,
/* A symbol to use in the relocation. Make a note
of this if we are not just counting. */
case 'S':
if (! just_count && (unsigned int) c < symcount)
if (!just_count && symbols != NULL && (unsigned int) c < symcount)
rptr->sym_ptr_ptr = &symbols[c];
break;
/* Argument relocation bits for a function call. */

2
binutils/objdump.c
View File

@ -4238,7 +4238,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
relocs = (arelent **) xmalloc (reloc_size);
reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, NULL);
reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, syms);
if (reloc_count <= 0)
free (relocs);
else