PR binutils/22875: FRV/ELF: Prevent an out-of-bounds howto table access

Prevent an out-of-bounds `elf32_frv_howto_table' table access in
`frv_info_to_howto_rela' by using the size of the table rather than
R_FRV_max to determine the number of entries in the contiguous regular
FRV relocation range defined and described in the table.

	bfd/
	* elf32-frv.c (frv_info_to_howto_rela): Correct the range check
	for `elf32_frv_howto_table' table access.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index c5e0a91..072ad98 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,10 @@
 2018-04-04  Maciej W. Rozycki  <macro@mips.com>
 
+       * elf32-frv.c (frv_info_to_howto_rela): Correct the range check
+       for `elf32_frv_howto_table' table access.
+
+2018-04-04  Maciej W. Rozycki  <macro@mips.com>
+
        * elf32-mips.c (mips_elf32_rtype_to_howto): Also return
        unsuccessfully for placeholder howtos.
        * elf64-mips.c (mips_elf64_rtype_to_howto): Likewise.

diff --git a/bfd/elf32-frv.c b/bfd/elf32-frv.c
index 7831aff..fc0bdcd 100644 (file)
--- a/bfd/elf32-frv.c
+++ b/bfd/elf32-frv.c
@@ -25,6 +25,7 @@
 #include "elf/frv.h"
 #include "dwarf2.h"
 #include "hashtab.h"
+#include "libiberty.h"
 
 /* Forward declarations.  */
 
@@ -2551,7 +2552,7 @@ frv_info_to_howto_rela (bfd *abfd ATTRIBUTE_UNUSED,
       break;
 
     default:
-      if (r_type >= (unsigned int) R_FRV_max)
+      if (r_type >= ARRAY_SIZE (elf32_frv_howto_table))
        {
          /* xgettext:c-format */
          _bfd_error_handler (_("%pB: unsupported relocation type %#x"),