mips64 linker accesses out-of-bounds array

[Alexandre Oliva]

The reloc count of a bfd is initialized to the size of the reloc
section divided by the size of each entry.  Later on,
mips_elf64_slurp_one_reloc_table() recomputes reloc_count as the
number of separate relocations, with up to 3 internal relocations per
external relocation.  We allocate enough memory for the 3 internal
relocations, but then, reloc_count grows, and then elfxx-mips.c ends
up using the cached relocation array (allocated before it grew) and
iterating over 3 times the grown relocation count, so it ends up
finding some, erhm, unexpected relocation types.

This patch arranges for us to create exactly three internal
relocations per external relocation, as we do elsewhere.  It fixes the
crash problem at hand, but I still see too many triple-NONE
relocations (that were already there before, FWIW), so some further
investigation is necessary to figure out where these unnecessary
relocations come from.

Meanwhile, ok to install?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: mips64-bfd-reloc-count.patch
Type: text/x-patch
Size: 1922 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20021105/26246607/attachment.bin>
-------------- next part --------------

-- 
Alexandre Oliva   Enjoy Guarana', see http://www.ic.unicamp.br/~oliva/
Red Hat GCC Developer                 aoliva@{redhat.com, gcc.gnu.org}
CS PhD student at IC-Unicamp        oliva@{lsd.ic.unicamp.br, gnu.org}
Free Software Evangelist                Professional serial bug killer