Fix a seg-fault when processing a corrupt binary containing reloc(s) with negative...

[deliverable/binutils-gdb.git] / bfd / reloc.c

diff --git a/bfd/reloc.c b/bfd/reloc.c
index 279145851682297baea11742cd1fc930f3c8d614..9a04022c50c21ea13bc97155eb80d786fa40cd8c 100644 (file)
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -624,7 +624,10 @@ bfd_perform_relocation (bfd *abfd,
      PR 17512: file: c146ab8b, 46dff27f, 38e53ebf.  */
   octets = reloc_entry->address * bfd_octets_per_byte (abfd);
   if (octets + bfd_get_reloc_size (howto)
-      > bfd_get_section_limit_octets (abfd, input_section))
+      > bfd_get_section_limit_octets (abfd, input_section)
+      /* Check for an overly large offset which
+        masquerades as a negative value too.  */
+      || (octets + bfd_get_reloc_size (howto) < bfd_get_reloc_size (howto)))
     return bfd_reloc_outofrange;
 
   /* Work out which section the relocation is targeted at and the