[binutils-gdb] Prevent an illegal memory access via an out of range fixup pointer.

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e9af4700bc7435e593dd74d4d2e099b3d7c01eb6

commit e9af4700bc7435e593dd74d4d2e099b3d7c01eb6
Author: Nick Clifton <nickc@redhat.com>
Date:   Mon Apr 16 12:59:37 2018 +0100

    Prevent an illegal memory access via an out of range fixup pointer.
    
    	PR 23061
    	* coffgen.c (coff_pointerize_aux): Check for an out of range
    	fixup.

Diff:
---
 bfd/ChangeLog | 6 ++++++
 bfd/coffgen.c | 6 ++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 9f81866..3ea3933 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-04-16  Nick Clifton  <nickc@redhat.com>
+
+	PR 23061
+	* coffgen.c (coff_pointerize_aux): Check for an out of range
+	fixup.
+
 2018-04-16  Alan Modra  <amodra@gmail.com>
 
 	* Makefile.am: Remove arm-epoc-pe support.
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index ff445d2..b9e4872 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -835,7 +835,7 @@ coff_mangle_symbols (bfd *bfd_ptr)
 	  for (i = 0; i < s->u.syment.n_numaux; i++)
 	    {
 	      combined_entry_type *a = s + i + 1;
-
+	      
 	      BFD_ASSERT (! a->is_sym);
 	      if (a->fix_tag)
 		{
@@ -1547,7 +1547,9 @@ coff_pointerize_aux (bfd *abfd,
 
   if ((ISFCN (type) || ISTAG (n_sclass) || n_sclass == C_BLOCK
        || n_sclass == C_FCN)
-      && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0)
+      && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l > 0
+      && auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l
+      < (long) obj_raw_syment_count (abfd))
     {
       auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.p =
 	table_base + auxent->u.auxent.x_sym.x_fcnary.x_fcn.x_endndx.l;