buffer overflow in mmix_elf_relocate_section

[Alan Modra]

	* elf64-mmix.c (mmix_elf_relocate_section): Correct size of
	relocs shuffled by memmove.

diff --git a/bfd/elf64-mmix.c b/bfd/elf64-mmix.c
index c377222676d..5bb6feee16e 100644
--- a/bfd/elf64-mmix.c
+++ b/bfd/elf64-mmix.c
@@ -1496,7 +1496,7 @@ mmix_elf_relocate_section (bfd *output_bfd ATTRIBUTE_UNUSED,
 		  /* Shift this reloc to the end of the relocs to maintain
 		     the r_offset sorted reloc order.  */
 		  relcpy = *rel;
-		  memmove (rel, rel + 1, (char *) relend - (char *) rel);
+		  memmove (rel, rel + 1, (char *) relend - (char *) (rel + 1));
 		  relend[-1] = relcpy;
 
 		  /* Back up one reloc, or else we'd skip the next reloc

-- 
Alan Modra