* PR24336, buffer overflow in swap_reloca_in
@ 2019-03-15 9:38 Alan Modra
0 siblings, 0 replies; only message in thread
From: Alan Modra @ 2019-03-15 9:38 UTC (permalink / raw)
To: binutils
PR 24336
* elflink.c (elf_link_read_relocs_from_section): Handle fuzzed
object files with sh_size not a multiple of sh_entsize.
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 3413726b94..2600c3934b 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -2523,9 +2523,11 @@ elf_link_read_relocs_from_section (bfd *abfd,
}
erela = (const bfd_byte *) external_relocs;
- erelaend = erela + shdr->sh_size;
+ /* Setting erelaend like this and comparing with <= handles case of
+ a fuzzed object with sh_size not a multiple of sh_entsize. */
+ erelaend = erela + shdr->sh_size - shdr->sh_entsize;
irela = internal_relocs;
- while (erela < erelaend)
+ while (erela <= erelaend)
{
bfd_vma r_symndx;
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-03-15 9:38 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-15 9:38 PR24336, buffer overflow in swap_reloca_in Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).