[binutils-gdb] PR22741, objcopy segfault on fuzzed COFF object

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eb77f6a4621795367a39cdd30957903af9dbb815

commit eb77f6a4621795367a39cdd30957903af9dbb815
Author: Alan Modra <amodra@gmail.com>
Date:   Sat Jan 27 08:19:33 2018 +1030

    PR22741, objcopy segfault on fuzzed COFF object
    
    	PR 22741
    	* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
    	range before converting to a symbol table pointer.

Diff:
---
 bfd/ChangeLog | 6 ++++++
 bfd/coffgen.c | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 83532c0f..9566198 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-01-29  Alan Modra  <amodra@gmail.com>
+
+	PR 22741
+	* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
+	range before converting to a symbol table pointer.
+
 2018-01-27  Nick Clifton  <nickc@redhat.com>
 
 	* po/ru.po: Updated Russian translation.
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b241087..4f90ead 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
     }
   /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
      generate one, so we must be careful to ignore it.  */
-  if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+  if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+      < obj_raw_syment_count (abfd))
     {
       auxent->u.auxent.x_sym.x_tagndx.p =
 	table_base + auxent->u.auxent.x_sym.x_tagndx.l;