[patch] RELOC_AGAINST_DISCARDED_SECTION crash on +1 overrun

[Jan Kratochvil]

Hi,

from a reported core file created this patch.  memmove was trying to read
memory after a page boundary.  (I do not have the fix verified.)

No regressions on {x86_64,i686}-fedora15-linux-gnu.


Thanks,
Jan


bfd/
2011-04-19  Jan Kratochvil  <jan.kratochvil@redhat.com>

	* elf-bfd.h (RELOC_AGAINST_DISCARDED_SECTION): Fix +1 overrun of
	memmove elements.

--- a/bfd/elf-bfd.h
+++ b/bfd/elf-bfd.h
@@ -2405,7 +2405,7 @@ extern asection _bfd_elf_large_com_section;
 	    rel_hdr = _bfd_elf_single_rel_hdr (input_section);		\
 	    rel_hdr->sh_size -= rel_hdr->sh_entsize;			\
 									\
-	    memmove (rel, rel + 1, (relend - rel) * sizeof (*rel));	\
+	    memmove (rel, rel + 1, (relend - rel - 1) * sizeof (*rel));	\
 									\
 	    input_section->reloc_count--;				\
 	    relend--;							\