From: Alan Modra <amodra@gmail.com>
Date: Sun, 28 Jul 2019 05:26:37 +0000 (+0930)
Subject: PR24857, ld: error adding symbols: bad value
X-Git-Tag: binutils-2_33~390
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4538d1c7c46e67b472d8d5ebf163f3dfd9c67714;p=external%2Fbinutils.git

PR24857, ld: error adding symbols: bad value

This fixes two cases where elf_link_add_object_symbols returns an
error, setting the catch-all bfd_error_bad_value without explaining
the error.  The second one is an internal error that can only be
caused by a target elf_add_symbol_hook, so make that one abort.  The
first one is my PR24339 fix.  PR24339 is another of those fuzzing bugs
and the fix I made catches the problem when loading symbols, rather
than when symbols are used in relocs.  While ld is correct to reject
the object file as not complying with the ELF standard, let's be a
little more forgiving for dynamic objects.

	PR 24857
	PR 24339
	* elflink.c (elf_link_add_object_symbols): Report an informative
	error on finding local symbols with index equal or greater than
	symbol table sh_info.  Correct comment.  Allow such symbols in
	dynamic objects.  Abort on NULL section for symbol.
---

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 05ea634..1364904 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,12 @@
+2019-07-28  Alan Modra  <amodra@gmail.com>
+
+	PR 24857
+	PR 24339
+	* elflink.c (elf_link_add_object_symbols): Report an informative
+	error on finding local symbols with index equal or greater than
+	symbol table sh_info.  Correct comment.  Allow such symbols in
+	dynamic objects.  Abort on NULL section for symbol.
+
 2019-07-26  Alan Modra  <amodra@gmail.com>
 
 	* elf-bfd.h (struct output_elf_obj_tdata): Delete "linker" field.
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 98941cc..ad146d4 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -4421,6 +4421,7 @@ error_free_dyn:
       bfd_boolean common;
       bfd_boolean discarded;
       unsigned int old_alignment;
+      unsigned int shindex;
       bfd *old_bfd;
       bfd_boolean matched;
 
@@ -4450,7 +4451,19 @@ error_free_dyn:
 	    continue;
 
 	  /* If we aren't prepared to handle locals within the globals
-	     then we'll likely segfault on a NULL section.  */
+	     then we'll likely segfault on a NULL symbol hash if the
+	     symbol is ever referenced in relocations.  */
+	  shindex = elf_elfheader (abfd)->e_shstrndx;
+	  name = bfd_elf_string_from_elf_section (abfd, shindex, hdr->sh_name);
+	  _bfd_error_handler (_("%pB: %s local symbol at index %lu"
+				" (>= sh_info of %lu)"),
+			      abfd, name, (long) (isym - isymbuf + extsymoff),
+			      (long) extsymoff);
+
+	  /* Dynamic object relocations are not processed by ld, so
+	     ld won't run into the problem mentioned above.  */
+	  if (dynamic)
+	    continue;
 	  bfd_set_error (bfd_error_bad_value);
 	  goto error_free_vers;
 
@@ -4550,10 +4563,7 @@ error_free_dyn:
 
       /* Sanity check that all possibilities were handled.  */
       if (sec == NULL)
-	{
-	  bfd_set_error (bfd_error_bad_value);
-	  goto error_free_vers;
-	}
+	abort ();
 
       /* Silently discard TLS symbols from --just-syms.  There's
 	 no way to combine a static TLS block with a new TLS block