Fix memory access violations for objdump triggered by fuzzed binaries.

	PR binutils/17512
	* reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
	(bfd_perform_relocation): Include the size of the reloc in the
	test for an out of range relocation.
	(bfd_generic_get_relocated_section_contents): Remove reloc range
	test.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index efcb63a..383cf29 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,6 +1,12 @@
 2015-01-06  Nick Clifton  <nickc@redhat.com>
 
        PR binutils/17512
+       * reloc.c (bfd_get_reloc_size): Handle a reloc size of -1.
+       (bfd_perform_relocation): Include the size of the reloc in the
+       test for an out of range relocation.
+       (bfd_generic_get_relocated_section_contents): Remove reloc range
+       test.
+
        * coff-i860.c (CALC_ADDEND): Always set an addend value.
        * tekhex.c (getvalue): Add an end pointer parameter.  Use it to
        avoid reading off the end of the buffer.

diff --git a/bfd/reloc.c b/bfd/reloc.c
index fe7d8be..4167608 100644 (file)
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -437,6 +437,7 @@ bfd_get_reloc_size (reloc_howto_type *howto)
     case 3: return 0;
     case 4: return 8;
     case 8: return 16;
+    case -1: return 2;
     case -2: return 4;
     default: abort ();
     }
@@ -618,7 +619,11 @@ bfd_perform_relocation (bfd *abfd,
     }
 
   /* Is the address of the relocation really within the section?  */
-  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
+  if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)
+      /* PR 17512: file: c146ab8b.
+        PR 17512: file: 46dff27f.
+        Include the size of the reloc in the test for out of range addresses.  */
+      - bfd_get_reloc_size (howto))
     return bfd_reloc_outofrange;
 
   /* Work out which section the relocation is targeted at and the
@@ -7623,10 +7628,6 @@ bfd_generic_get_relocated_section_contents (bfd *abfd,
              (*parent)->howto = &none_howto;
              r = bfd_reloc_ok;
            }
-         /* PR 17512: file: c146ab8b.  */
-         else if ((*parent)->address * bfd_octets_per_byte (abfd)
-                  >= bfd_get_section_size (input_section))
-           r = bfd_reloc_outofrange;
          else
            r = bfd_perform_relocation (input_bfd,
                                        *parent,