PR22509 - Null pointer dereference on coff_slurp_reloc_table
Checks
Commit Message
This extends the commit 4581a1c7d304 fix to more targets, which
hardens BFD a little. I think the real underlying problem was the
bfd_canonicalize_reloc call in load_specific_debug_section which
passed a NULL for "symbols". Fix that too.
PR 22509
bfd/
* aoutx.h (swap_ext_reloc_out): Gracefully handle NULL symbols.
* i386lynx.c (swap_ext_reloc_out): Likewise.
* pdp11.c (pdp11_aout_swap_reloc_out): Likewise.
* coff-tic30.c (reloc_processing): Likewise.
* coff-tic4x.c (tic4x_reloc_processing): Likewise.
* coff-tic54x.c (tic54x_reloc_processing): Likewise.
* coff-z80.c (reloc_processing): Likewise.
* coff-z8k.c (reloc_processing): Likewise.
* ecoff.c (ecoff_slurp_reloc_table): Likewise.
* som.c (som_set_reloc_info): Likewise.
binutils/
* objdump.c (load_specific_debug_section): Pass syms to
bfd_canonicalize_reloc.
@@ -2122,8 +2122,10 @@ NAME (aout, swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* Undefined symbol. */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
@@ -161,7 +161,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
@@ -219,7 +219,7 @@ tic4x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
- if (reloc->r_symndx != -1)
+ if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{
@@ -357,7 +357,7 @@ tic54x_reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
- if (reloc->r_symndx != -1)
+ if (reloc->r_symndx != -1 && symbols != NULL)
{
if (reloc->r_symndx < 0 || reloc->r_symndx >= obj_conv_table_size (abfd))
{
@@ -314,7 +314,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
@@ -177,7 +177,7 @@ reloc_processing (arelent *relent,
relent->address = reloc->r_vaddr;
rtype2howto (relent, reloc);
- if (reloc->r_symndx == -1)
+ if (reloc->r_symndx == -1 || symbols == NULL)
relent->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr;
else if (reloc->r_symndx >= 0 && reloc->r_symndx < obj_conv_table_size (abfd))
relent->sym_ptr_ptr = symbols + obj_convert (abfd)[reloc->r_symndx];
@@ -1612,7 +1612,8 @@ ecoff_slurp_reloc_table (bfd *abfd,
if (intern.r_extern)
{
/* r_symndx is an index into the external symbols. */
- if (intern.r_symndx >= 0
+ if (symbols != NULL
+ && intern.r_symndx >= 0
&& (intern.r_symndx
< (ecoff_data (abfd)->debug_info.symbolic_header.iextMax)))
rptr->sym_ptr_ptr = symbols + intern.r_symndx;
@@ -283,8 +283,10 @@ NAME(lynx,swap_ext_reloc_out) (bfd *abfd,
if (r_extern) \
{ \
/* undefined symbol */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
@@ -1861,8 +1861,10 @@ pdp11_aout_swap_reloc_out (bfd *abfd, arelent *g, bfd_byte *natptr)
if (r_extern) \
{ \
/* Undefined symbol. */ \
- if (r_index < bfd_get_symcount (abfd)) \
+ if (symbols != NULL && r_index < bfd_get_symcount (abfd)) \
cache_ptr->sym_ptr_ptr = symbols + r_index; \
+ else \
+ cache_ptr->sym_ptr_ptr = bfd_abs_section_ptr->symbol_ptr_ptr; \
cache_ptr->addend = ad; \
} \
else \
@@ -5099,7 +5099,7 @@ som_set_reloc_info (unsigned char *fixup,
/* A symbol to use in the relocation. Make a note
of this if we are not just counting. */
case 'S':
- if (! just_count && (unsigned int) c < symcount)
+ if (!just_count && symbols != NULL && (unsigned int) c < symcount)
rptr->sym_ptr_ptr = &symbols[c];
break;
/* Argument relocation bits for a function call. */
@@ -4238,7 +4238,7 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
relocs = (arelent **) xmalloc (reloc_size);
- reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, NULL);
+ reloc_count = bfd_canonicalize_reloc (abfd, sec, relocs, syms);
if (reloc_count <= 0)
free (relocs);
else