[binutils-gdb] buffer overflow in mmix_elf_relocate_section

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7976c00c183f700e60031c67b3cc49875323c02e

commit 7976c00c183f700e60031c67b3cc49875323c02e
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Jan 17 14:41:39 2025 +1030

    buffer overflow in mmix_elf_relocate_section
    
            * elf64-mmix.c (mmix_elf_relocate_section): Correct size of
            relocs shuffled by memmove.

Diff:
---
 bfd/elf64-mmix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bfd/elf64-mmix.c b/bfd/elf64-mmix.c
index c377222676d..5bb6feee16e 100644
--- a/bfd/elf64-mmix.c
+++ b/bfd/elf64-mmix.c
@@ -1496,7 +1496,7 @@ mmix_elf_relocate_section (bfd *output_bfd ATTRIBUTE_UNUSED,
 		  /* Shift this reloc to the end of the relocs to maintain
 		     the r_offset sorted reloc order.  */
 		  relcpy = *rel;
-		  memmove (rel, rel + 1, (char *) relend - (char *) rel);
+		  memmove (rel, rel + 1, (char *) relend - (char *) (rel + 1));
 		  relend[-1] = relcpy;
 
 		  /* Back up one reloc, or else we'd skip the next reloc