Attachment #475460 for bug #621130

Lines 1-3 Link Here

(-)a/binutils/ChangeLog (+7 lines)
		1	2017-02-13 Nick Clifton <nickc@redhat.com>
		2
		3	PR binutils/21137
		4	* readelf.c (target_specific_reloc_handling): Add end parameter.
		5	Check for buffer overflow before writing relocated values.
		6	(apply_relocations): Pass end to target_specific_reloc_handling.
		7
1	2017-03-02 Tristan Gingold <gingold@adacore.com>	8	2017-03-02 Tristan Gingold <gingold@adacore.com>
2		9
3	* configure: Regenerate.	10	* configure: Regenerate.




static bfd_boolean
target_specific_reloc_handling (Elf_Internal_Rela * reloc,
				unsigned char *     start,
				unsigned char *     end,
				Elf_Internal_Sym *  symtab)
{
  unsigned int reloc_type = get_reloc_type (reloc->r_info);

	  handle_sym_diff:
	    if (saved_sym != NULL)
	      {
		int reloc_size = reloc_type == 1 ? 4 : 2;
		bfd_vma value;

		value = reloc->r_addend
		  + (symtab[get_reloc_symindex (reloc->r_info)].st_value
		     - saved_sym->st_value);

		if (start + reloc->r_offset + reloc_size >= end)
		  /* PR 21137 */
		  error (_("MSP430 sym diff reloc writes past end of section (%p vs %p)\n"),
			 start + reloc->r_offset + reloc_size, end);
		else
		  byte_put (start + reloc->r_offset, value, reloc_size);

		saved_sym = NULL;
		return TRUE;

	  case 2: /* R_MN10300_16 */
	    if (saved_sym != NULL)
	      {
		int reloc_size = reloc_type == 1 ? 4 : 2;
		bfd_vma value;

		value = reloc->r_addend
		  + (symtab[get_reloc_symindex (reloc->r_info)].st_value
		     - saved_sym->st_value);

		if (start + reloc->r_offset + reloc_size >= end)
		  error (_("MN10300 sym diff reloc writes past end of section (%p vs %p)\n"),
			 start + reloc->r_offset + reloc_size, end);
		else
		  byte_put (start + reloc->r_offset, value, reloc_size);

		saved_sym = NULL;
		return TRUE;

	    break;

	  case 0x41: /* R_RL78_ABS32.  */
	    if (start + reloc->r_offset + 4 >= end)
	      error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
		     start + reloc->r_offset + 2, end);
	    else
	      byte_put (start + reloc->r_offset, value, 4);
	    value = 0;
	    return TRUE;

	  case 0x43: /* R_RL78_ABS16.  */
	    if (start + reloc->r_offset + 2 >= end)
	      error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
		     start + reloc->r_offset + 2, end);
	    else
	      byte_put (start + reloc->r_offset, value, 2);
	    value = 0;
	    return TRUE;



	  reloc_type = get_reloc_type (rp->r_info);

	  if (target_specific_reloc_handling (rp, start, end, symtab))
	    continue;
	  else if (is_none_reloc (reloc_type))
	    continue;
- 

Return to bug 621130

Lines 11585-11590 process_syminfo (FILE * file ATTRIBUTE_UNUSED) Link Here

(-)a/binutils/readelf.c (-6 / +25 lines)
11585	static bfd_boolean	11585	static bfd_boolean
11586	target_specific_reloc_handling (Elf_Internal_Rela * reloc,	11586	target_specific_reloc_handling (Elf_Internal_Rela * reloc,
11587	unsigned char * start,	11587	unsigned char * start,
		11588	unsigned char * end,
11588	Elf_Internal_Sym * symtab)	11589	Elf_Internal_Sym * symtab)
11589	{	11590	{
11590	unsigned int reloc_type = get_reloc_type (reloc->r_info);	11591	unsigned int reloc_type = get_reloc_type (reloc->r_info);
Lines 11625-11637 target_specific_reloc_handling (Elf_Internal_Rela * reloc, Link Here
11625	handle_sym_diff:	11626	handle_sym_diff:
11626	if (saved_sym != NULL)	11627	if (saved_sym != NULL)
11627	{	11628	{
		11629	int reloc_size = reloc_type == 1 ? 4 : 2;
11628	bfd_vma value;	11630	bfd_vma value;
11629		11631
11630	value = reloc->r_addend	11632	value = reloc->r_addend
11631	+ (symtab[get_reloc_symindex (reloc->r_info)].st_value	11633	+ (symtab[get_reloc_symindex (reloc->r_info)].st_value
11632	- saved_sym->st_value);	11634	- saved_sym->st_value);
11633		11635
11634	byte_put (start + reloc->r_offset, value, reloc_type == 1 ? 4 : 2);	11636	if (start + reloc->r_offset + reloc_size >= end)
		11637	/* PR 21137 */
		11638	error (_("MSP430 sym diff reloc writes past end of section (%p vs %p)\n"),
		11639	start + reloc->r_offset + reloc_size, end);
		11640	else
		11641	byte_put (start + reloc->r_offset, value, reloc_size);
11635		11642
11636	saved_sym = NULL;	11643	saved_sym = NULL;
11637	return TRUE;	11644	return TRUE;
Lines 11662-11674 target_specific_reloc_handling (Elf_Internal_Rela * reloc, Link Here
11662	case 2: /* R_MN10300_16 */	11669	case 2: /* R_MN10300_16 */
11663	if (saved_sym != NULL)	11670	if (saved_sym != NULL)
11664	{	11671	{
		11672	int reloc_size = reloc_type == 1 ? 4 : 2;
11665	bfd_vma value;	11673	bfd_vma value;
11666		11674
11667	value = reloc->r_addend	11675	value = reloc->r_addend
11668	+ (symtab[get_reloc_symindex (reloc->r_info)].st_value	11676	+ (symtab[get_reloc_symindex (reloc->r_info)].st_value
11669	- saved_sym->st_value);	11677	- saved_sym->st_value);
11670		11678
11671	byte_put (start + reloc->r_offset, value, reloc_type == 1 ? 4 : 2);	11679	if (start + reloc->r_offset + reloc_size >= end)
		11680	error (_("MN10300 sym diff reloc writes past end of section (%p vs %p)\n"),
		11681	start + reloc->r_offset + reloc_size, end);
		11682	else
		11683	byte_put (start + reloc->r_offset, value, reloc_size);
11672		11684
11673	saved_sym = NULL;	11685	saved_sym = NULL;
11674	return TRUE;	11686	return TRUE;
Lines 11703-11714 target_specific_reloc_handling (Elf_Internal_Rela * reloc, Link Here
11703	break;	11715	break;
11704		11716
11705	case 0x41: /* R_RL78_ABS32. */	11717	case 0x41: /* R_RL78_ABS32. */
11706	byte_put (start + reloc->r_offset, value, 4);	11718	if (start + reloc->r_offset + 4 >= end)
		11719	error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
		11720	start + reloc->r_offset + 2, end);
		11721	else
		11722	byte_put (start + reloc->r_offset, value, 4);
11707	value = 0;	11723	value = 0;
11708	return TRUE;	11724	return TRUE;
11709		11725
11710	case 0x43: /* R_RL78_ABS16. */	11726	case 0x43: /* R_RL78_ABS16. */
11711	byte_put (start + reloc->r_offset, value, 2);	11727	if (start + reloc->r_offset + 2 >= end)
		11728	error (_("RL78 sym diff reloc writes past end of section (%p vs %p)\n"),
		11729	start + reloc->r_offset + 2, end);
		11730	else
		11731	byte_put (start + reloc->r_offset, value, 2);
11712	value = 0;	11732	value = 0;
11713	return TRUE;	11733	return TRUE;
11714		11734
Lines 12325-12331 apply_relocations (void * file, Link Here
12325		12345
12326	reloc_type = get_reloc_type (rp->r_info);	12346	reloc_type = get_reloc_type (rp->r_info);
12327		12347
12328	if (target_specific_reloc_handling (rp, start, symtab))	12348	if (target_specific_reloc_handling (rp, start, end, symtab))
12329	continue;	12349	continue;
12330	else if (is_none_reloc (reloc_type))	12350	else if (is_none_reloc (reloc_type))
12331	continue;	12351	continue;
12332	-