[binutils-gdb/binutils-2_35-branch] Fix an illegal memory access in the BFD library which can be triggered by an attempt to parse a corr

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=78fede7066a6baf1db64780abadc70194585a85e

commit 78fede7066a6baf1db64780abadc70194585a85e
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jul 15 11:15:16 2020 +0100

    Fix an illegal memory access in the BFD library which can be triggered by an attempt to parse a corrupt PE format file.
    
            PR26240
            * coffgen.c (coff_get_normalized_symtab): Fix off-by-one error in
            check for aux entries that overflow the buufer.

Diff:
---
 bfd/ChangeLog | 6 ++++++
 bfd/coffgen.c | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index fd0f1c7d54d..312df82c409 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2020-07-15  Nick Clifton  <nickc@redhat.com>
+
+	PR26240
+	* coffgen.c (coff_get_normalized_symtab): Fix off-by-one error in
+	check for aux entries that overflow the buufer.
+
 2020-07-10  Alan Modra  <amodra@gmail.com>
 
 	* elf64-ppc.h (struct ppc64_elf_params): Add power10_stubs.
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index 3291b693eb0..c10dac2acf5 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1814,7 +1814,7 @@ coff_get_normalized_symtab (bfd *abfd)
       internal_ptr->is_sym = TRUE;
 
       /* PR 17512: Prevent buffer overrun.  */
-      if (symbol_ptr->u.syment.n_numaux > (raw_end - raw_src) / symesz)
+      if (symbol_ptr->u.syment.n_numaux > ((raw_end - 1) - raw_src) / symesz)
 	{
 	  bfd_release (abfd, internal);
 	  return NULL;