PR24857, ld: error adding symbols: bad value

This fixes two cases where elf_link_add_object_symbols returns an
error, setting the catch-all bfd_error_bad_value without explaining
the error.  The second one is an internal error that can only be
caused by a target elf_add_symbol_hook, so make that one abort.  The
first one is my PR24339 fix.  PR24339 is another of those fuzzing bugs
and the fix I made catches the problem when loading symbols, rather
than when symbols are used in relocs.  While ld is correct to reject
the object file as not complying with the ELF standard, let's be a
little more forgiving for dynamic objects.

	PR 24857
	PR 24339
	* elflink.c (elf_link_add_object_symbols): Report an informative
	error on finding local symbols with index equal or greater than
	symbol table sh_info.  Correct comment.  Allow such symbols in
	dynamic objects.  Abort on NULL section for symbol.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 05ea634b68873f463d38ab0e33944cdaa28ed025..13649040c080a8b6aabe347b29475bba6421c42a 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,12 @@
+2019-07-28  Alan Modra  <amodra@gmail.com>
+
+       PR 24857
+       PR 24339
+       * elflink.c (elf_link_add_object_symbols): Report an informative
+       error on finding local symbols with index equal or greater than
+       symbol table sh_info.  Correct comment.  Allow such symbols in
+       dynamic objects.  Abort on NULL section for symbol.
+
 2019-07-26  Alan Modra  <amodra@gmail.com>
 
        * elf-bfd.h (struct output_elf_obj_tdata): Delete "linker" field.

diff --git a/bfd/elflink.c b/bfd/elflink.c
index 98941cccd0db354505ea8c806035d4e21b75de70..ad146d48fc92b073978cff054b80f72adcfb21a8 100644 (file)
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -4421,6 +4421,7 @@ error_free_dyn:
       bfd_boolean common;
       bfd_boolean discarded;
       unsigned int old_alignment;
+      unsigned int shindex;
       bfd *old_bfd;
       bfd_boolean matched;
 
@@ -4450,7 +4451,19 @@ error_free_dyn:
            continue;
 
          /* If we aren't prepared to handle locals within the globals
-            then we'll likely segfault on a NULL section.  */
+            then we'll likely segfault on a NULL symbol hash if the
+            symbol is ever referenced in relocations.  */
+         shindex = elf_elfheader (abfd)->e_shstrndx;
+         name = bfd_elf_string_from_elf_section (abfd, shindex, hdr->sh_name);
+         _bfd_error_handler (_("%pB: %s local symbol at index %lu"
+                               " (>= sh_info of %lu)"),
+                             abfd, name, (long) (isym - isymbuf + extsymoff),
+                             (long) extsymoff);
+
+         /* Dynamic object relocations are not processed by ld, so
+            ld won't run into the problem mentioned above.  */
+         if (dynamic)
+           continue;
          bfd_set_error (bfd_error_bad_value);
          goto error_free_vers;
 
@@ -4550,10 +4563,7 @@ error_free_dyn:
 
       /* Sanity check that all possibilities were handled.  */
       if (sec == NULL)
-       {
-         bfd_set_error (bfd_error_bad_value);
-         goto error_free_vers;
-       }
+       abort ();
 
       /* Silently discard TLS symbols from --just-syms.  There's
         no way to combine a static TLS block with a new TLS block