MIPS/GAS: Fix null pointer dereferences in R6 PC-relative relocation checks

Avoid segmentation faults in alignment checks made in `md_apply_fix' for
BFD_RELOC_MIPS_18_PCREL_S3 and BFD_RELOC_MIPS_19_PCREL_S2 relocations
caused by dereferencing `fixP->fx_addsy' which will be null if the
relocation processed has been fully resolved.

	gas/
	* config/tc-mips.c (md_apply_fix) <BFD_RELOC_MIPS_18_PCREL_S3>
	<BFD_RELOC_MIPS_19_PCREL_S2>: Avoid null pointer dereferences
	via `fixP->fx_addsy'.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 45a5054..6ccbaa2 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,5 +1,11 @@
 2016-06-21  Maciej W. Rozycki  <macro@imgtec.com>
 
+       * config/tc-mips.c (md_apply_fix) <BFD_RELOC_MIPS_18_PCREL_S3>
+       <BFD_RELOC_MIPS_19_PCREL_S2>: Avoid null pointer dereferences
+       via `fixP->fx_addsy'.
+
+2016-06-21  Maciej W. Rozycki  <macro@imgtec.com>
+
        * config/tc-mips.c (md_pcrel_from) <BFD_RELOC_MIPS_18_PCREL_S3>:
        Calculate relocation from the containing aligned doubleword.
        (tc_gen_reloc) <BFD_RELOC_MIPS_18_PCREL_S3>: Calculate the

diff --git a/gas/config/tc-mips.c b/gas/config/tc-mips.c
index 74f7e00..c598806 100644 (file)
--- a/gas/config/tc-mips.c
+++ b/gas/config/tc-mips.c
@@ -15034,7 +15034,7 @@ md_apply_fix (fixS *fixP, valueT *valP, segT seg ATTRIBUTE_UNUSED)
       break;
 
     case BFD_RELOC_MIPS_18_PCREL_S3:
-      if ((S_GET_VALUE (fixP->fx_addsy) & 0x7) != 0)
+      if (fixP->fx_addsy && (S_GET_VALUE (fixP->fx_addsy) & 0x7) != 0)
        as_bad_where (fixP->fx_file, fixP->fx_line,
                      _("PC-relative access using misaligned symbol (%lx)"),
                      (long) S_GET_VALUE (fixP->fx_addsy));
@@ -15050,7 +15050,7 @@ md_apply_fix (fixS *fixP, valueT *valP, segT seg ATTRIBUTE_UNUSED)
       if ((*valP & 0x3) != 0)
        as_bad_where (fixP->fx_file, fixP->fx_line,
                      _("PC-relative access to misaligned address (%lx)"),
-                     (long) (S_GET_VALUE (fixP->fx_addsy) + fixP->fx_offset));
+                     (long) *valP);
 
       gas_assert (!fixP->fx_done);
       break;