From: Matthias Klose <doko@debian.org>
Date: Wed, 16 May 2018 14:21:19 +0000 (+0100)
Subject: pr22741
X-Git-Tag: archive/raspbian/2.30-20+rpi1^2~8
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=36391b43c0996c07729d382b76f3354cc1b5e5a0;p=binutils.git

pr22741

# DP: PR22741, objcopy segfault on fuzzed COFF object

From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sat, 27 Jan 2018 08:19:33 +1030
Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object

	PR 22741
	* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
	range before converting to a symbol table pointer.

Gbp-Pq: Name pr22741.diff
---

diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b2410873d..4f90eaddd 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
     }
   /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
      generate one, so we must be careful to ignore it.  */
-  if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+  if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+      < obj_raw_syment_count (abfd))
     {
       auxent->u.auxent.x_sym.x_tagndx.p =
 	table_base + auxent->u.auxent.x_sym.x_tagndx.l;