[binutils-gdb/users/hjl/linux/master] Fix memory access violations for objdump triggered by fuzzed binaries.

[H.J.Lu <hjl at sourceware dot org>]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ec93045b400ec68b0c5716d75f27a87533b57058

commit ec93045b400ec68b0c5716d75f27a87533b57058
Author: Nick Clifton <nickc@redhat.com>
Date:   Tue Jan 6 17:54:02 2015 +0000

    Fix memory access violations for objdump triggered by fuzzed binaries.
    
    	PR binutils/17512
    	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
    	(bfd_perform_relocation): Include the size of the reloc in the
    	test for an out of range relocation.
    	(bfd_generic_get_relocated_section_contents): Remove reloc range
    	test.

Diff:
---
 bfd/ChangeLog |  6 ++++++
 bfd/reloc.c   | 11 ++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index efcb63a..383cf29 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,6 +1,12 @@
 2015-01-06  Nick Clifton  <nickc@redhat.com>
 
 	PR binutils/17512
+	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
+	(bfd_perform_relocation): Include the size of the reloc in the
+	test for an out of range relocation.
+	(bfd_generic_get_relocated_section_contents): Remove reloc range
+	test.
+
 	* coff-i860.c (CALC_ADDEND): Always set an addend value.
 	* tekhex.c (getvalue): Add an end pointer parameter.  Use it to
 	avoid reading off the end of the buffer.
diff --git a/bfd/reloc.c b/bfd/reloc.c
index fe7d8be..4167608 100644
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
     case 3: return 0;
     case 4: return 8;
     case 8: return 16;
+    case -1: return 2;
     case -2: return 4;
     default: abort ();
     }
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
     }
 
   /* Is the address of the relocation really within the section?  */
-  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
+  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
+      /* PR 17512: file: c146ab8b.
+	 PR 17512: file: 46dff27f.
+	 Include the size of the reloc in the test for out of range addresses.  */
+      - bfd_get_reloc_size (howto))
     return bfd_reloc_outofrange;
 
   /* Work out which section the relocation is targeted at and the
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
 	      (*parent)->howto = &none_howto;
 	      r = bfd_reloc_ok;
 	    }
-	  /* PR 17512: file: c146ab8b.  */
-	  else if ((*parent)->address * bfd_octets_per_byte (abfd)
-		   >= bfd_get_section_size (input_section))
-	    r = bfd_reloc_outofrange;
 	  else
 	    r = bfd_perform_relocation (input_bfd,
 					*parent,