From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by sourceware.org (Postfix) with ESMTPS id 4B9793858D39 for ; Mon, 6 Mar 2023 11:46:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4B9793858D39 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-x102b.google.com with SMTP id h17-20020a17090aea9100b0023739b10792so8586859pjz.1 for ; Mon, 06 Mar 2023 03:46:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1678103190; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=oQJEeBLCrxwuQowRCjhrJNdCyWH7KCt+D7J35LPev+4=; b=Rz1pKw41LsY61jD2CXlAt0Y5WL7GE6lYSWm+7B2aMkAqYnkMvoB8MhYS/GThfAn3qK FY2oIe/mkOyBTHjvYdD79ZAjznrQMBtR8yduQJUIkEKaSczNwKPul6DWg0wJizHXW2MK T+B29YFt6zhbhJR433OSoKAw2c57NjyC+S6/+iukVXMJfQWa7p61+94qREcfcfN5h4hB VVm25nrOV6ZfyEET+sAqK/yBUU2nTyFhFgaoxcBUIIYvyaqSj8ij9T29NtSXg58NTlKW 6AfZvj0kEL7BbjjAwwO+4g+7v43nKOaReeFS1sqDS2vTVIzgm0f9TPDEgYP4UTgRgESz RMfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678103190; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=oQJEeBLCrxwuQowRCjhrJNdCyWH7KCt+D7J35LPev+4=; b=5w2aGcBJatySat2pVEg8BtEL46U/yEUXQ2s4I7U8YE2tOhVVa36s84SRsiQ4mMfyMr YLZlPiDkGPpHIH6kqOiWYRR527VF7wI0bpjbtJck/Fc37j3FVCEVa0Yq7Nc7lqQURYzO vtWnYfDz8WI9HJfa6yHi8g2+Xh14IMq6V7Qtn72/l50rxas1Ko/anI/4n/ZQHFNI5wcV rEUF78p6qDmMDGh/Zy8D7w/wCiaBm8SAYTgGU/qGzLoiqMLtML0xmnBNzmRveeQKng7m orJUyufKNVlRCP0Pp7NoiVrTvIO76m/Ga9KDoBDiaoifmERwkJ/O5VCNqE9WZcs3vmsr 0DNQ== X-Gm-Message-State: AO0yUKUFruWa2Tb+TkOWbHbZjSjO+BqqUuppkbj77CXE/nIlySVieVjH ZzbHC364cdMKRB7M57iuB2ZRbqL/LWA= X-Google-Smtp-Source: AK7set+m0mDedkD9Kf7+lMC22c6YfuoHRayQXy/Sr+2usm9tj5Kzc1Tad0MofSIM3Dkcm/B3zgmE+A== X-Received: by 2002:a17:902:e80d:b0:19c:cb64:dacc with SMTP id u13-20020a170902e80d00b0019ccb64daccmr14233044plg.61.1678103190038; Mon, 06 Mar 2023 03:46:30 -0800 (PST) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id d6-20020a170902c18600b00199025284b3sm6525442pld.151.2023.03.06.03.46.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Mar 2023 03:46:29 -0800 (PST) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 2A8F9114087E; Mon, 6 Mar 2023 22:16:27 +1030 (ACDT) Date: Mon, 6 Mar 2023 22:16:27 +1030 From: Alan Modra To: binutils@sourceware.org Subject: macho null dereference read Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3035.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: The main problem here was not returning -1 from canonicalize_symtab on an error, leaving the vector of relocs only partly initialised and one with a null sym_ptr_ptr. * mach-o.c (bfd_mach_o_canonicalize_symtab): Return -1 on error, not 0. (bfd_mach_o_pre_canonicalize_one_reloc): Init sym_ptr_ptr to undefined section sym. diff --git a/bfd/mach-o.c b/bfd/mach-o.c index a910e1146ea..0a91095a5d6 100644 --- a/bfd/mach-o.c +++ b/bfd/mach-o.c @@ -919,7 +919,7 @@ bfd_mach_o_canonicalize_symtab (bfd *abfd, asymbol **alocation) { _bfd_error_handler (_("bfd_mach_o_canonicalize_symtab: unable to load symbols")); - return 0; + return -1; } BFD_ASSERT (sym->symbols != NULL); @@ -1554,7 +1554,7 @@ bfd_mach_o_pre_canonicalize_one_reloc (bfd *abfd, bfd_vma addr; addr = bfd_get_32 (abfd, raw->r_address); - res->sym_ptr_ptr = NULL; + res->sym_ptr_ptr = bfd_und_section_ptr->symbol_ptr_ptr; res->addend = 0; if (addr & BFD_MACH_O_SR_SCATTERED) @@ -1572,7 +1572,7 @@ bfd_mach_o_pre_canonicalize_one_reloc (bfd *abfd, end of the data for the section (e.g. in a calculation of section data length). At present, the symbol will end up associated with the following section or, if it falls within alignment padding, as - null - which will assert later. */ + the undefined section symbol. */ for (j = 0; j < mdata->nsects; j++) { bfd_mach_o_section *sect = mdata->sections[j]; -- Alan Modra Australia Development Lab, IBM