From 116acb2c268c89c89186673a7c92620d21825b25 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Wed, 28 Feb 2018 22:09:50 +1030 Subject: [PATCH] PR22887, null pointer dereference in aout_32_swap_std_reloc_out PR 22887 * aoutx.h (swap_std_reloc_in): Correct r_index bound check. --- bfd/ChangeLog | 5 +++++ bfd/aoutx.h | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 76a6499f6a..42cc700ce7 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,8 @@ +2018-02-28 Alan Modra + + PR 22887 + * aoutx.h (swap_std_reloc_in): Correct r_index bound check. + 2018-02-28 Nick Clifton PR 22894 diff --git a/bfd/aoutx.h b/bfd/aoutx.h index 4cadbfbd2f..525e5603ec 100644 --- a/bfd/aoutx.h +++ b/bfd/aoutx.h @@ -2289,10 +2289,12 @@ NAME (aout, swap_std_reloc_in) (bfd *abfd, if (r_baserel) r_extern = 1; - if (r_extern && r_index > symcount) + if (r_extern && r_index >= symcount) { /* We could arrange to return an error, but it might be useful - to see the file even if it is bad. */ + to see the file even if it is bad. FIXME: Of course this + means that objdump -r *doesn't* see the actual reloc, and + objcopy silently writes a different reloc. */ r_extern = 0; r_index = N_ABS; } -- 2.34.1