]> git.ipfire.org Git - thirdparty/binutils-gdb.git/blobdiff - bfd/elf.c
Avoid allocating over-large buffers when parsing corrupt binaries.
[thirdparty/binutils-gdb.git] / bfd / elf.c
index bf05ae0a80246768b21960f6028f27dab1a25f14..7cc0ce1fa6b8030d7b386da341270b3ecd5bceef 100644 (file)
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -1,6 +1,6 @@
 /* ELF executable support for BFD.
 
-   Copyright 1993-2013 Free Software Foundation, Inc.
+   Copyright (C) 1993-2014 Free Software Foundation, Inc.
 
    This file is part of BFD, the Binary File Descriptor library.
 
@@ -294,6 +294,11 @@ bfd_elf_get_str_section (bfd *abfd, unsigned int shindex)
       offset = i_shdrp[shindex]->sh_offset;
       shstrtabsize = i_shdrp[shindex]->sh_size;
 
+      /* PR binutils/17512: Do not even try to load
+        a string table bigger than the entire file...  */
+      if (shstrtabsize >= (bfd_size_type) bfd_get_size (abfd))
+       return NULL;
+
       /* Allocate and clear an extra byte at the end, to prevent crashes
         in case the string table is not terminated.  */
       if (shstrtabsize + 1 <= 1
@@ -608,9 +613,10 @@ setup_group (bfd *abfd, Elf_Internal_Shdr *hdr, asection *newsect)
                  if (shdr->contents == NULL)
                    {
                      _bfd_error_handler
-                       (_("%B: Corrupt size field in group section header: 0x%lx"), abfd, shdr->sh_size);
+                       (_("%B: corrupt size field in group section header: 0x%lx"), abfd, shdr->sh_size);
                      bfd_set_error (bfd_error_bad_value);
-                     return FALSE;
+                     -- num_group;
+                     continue;
                    }
 
                  memset (shdr->contents, 0, amt);
@@ -618,7 +624,16 @@ setup_group (bfd *abfd, Elf_Internal_Shdr *hdr, asection *newsect)
                  if (bfd_seek (abfd, shdr->sh_offset, SEEK_SET) != 0
                      || (bfd_bread (shdr->contents, shdr->sh_size, abfd)
                          != shdr->sh_size))
-                   return FALSE;
+                   {
+                     _bfd_error_handler
+                       (_("%B: invalid size field in group section header: 0x%lx"), abfd, shdr->sh_size);
+                     bfd_set_error (bfd_error_bad_value);
+                     -- num_group;
+                     /* PR 17510: If the group contents are even partially
+                        corrupt, do not allow any of the contents to be used.  */
+                     memset (shdr->contents, 0, amt);
+                     continue;
+                   }
 
                  /* Translate raw contents, a flag word followed by an
                     array of elf section indices all in target byte order,
@@ -651,6 +666,21 @@ setup_group (bfd *abfd, Elf_Internal_Shdr *hdr, asection *newsect)
                    }
                }
            }
+
+         /* PR 17510: Corrupt binaries might contain invalid groups.  */
+         if (num_group != (unsigned) elf_tdata (abfd)->num_group)
+           {
+             elf_tdata (abfd)->num_group = num_group;
+
+             /* If all groups are invalid then fail.  */
+             if (num_group == 0)
+               {
+                 elf_tdata (abfd)->group_sect_ptr = NULL;
+                 elf_tdata (abfd)->num_group = num_group = -1;
+                 (*_bfd_error_handler) (_("%B: no valid group sections found"), abfd);
+                 bfd_set_error (bfd_error_bad_value);
+               }
+           }
        }
     }
 
@@ -716,6 +746,7 @@ setup_group (bfd *abfd, Elf_Internal_Shdr *hdr, asection *newsect)
     {
       (*_bfd_error_handler) (_("%B: no group info for section %A"),
                             abfd, newsect);
+      return FALSE;
     }
   return TRUE;
 }
@@ -1117,13 +1148,17 @@ _bfd_elf_copy_private_bfd_data (bfd *ibfd, bfd *obfd)
       || bfd_get_flavour (obfd) != bfd_target_elf_flavour)
     return TRUE;
 
-  BFD_ASSERT (!elf_flags_init (obfd)
-             || (elf_elfheader (obfd)->e_flags
-                 == elf_elfheader (ibfd)->e_flags));
+  if (!elf_flags_init (obfd))
+    {
+      elf_elfheader (obfd)->e_flags = elf_elfheader (ibfd)->e_flags;
+      elf_flags_init (obfd) = TRUE;
+    }
 
   elf_gp (obfd) = elf_gp (ibfd);
-  elf_elfheader (obfd)->e_flags = elf_elfheader (ibfd)->e_flags;
-  elf_flags_init (obfd) = TRUE;
+
+  /* Also copy the EI_OSABI field.  */
+  elf_elfheader (obfd)->e_ident[EI_OSABI] =
+    elf_elfheader (ibfd)->e_ident[EI_OSABI];
 
   /* Copy object attributes.  */
   _bfd_elf_copy_obj_attributes (ibfd, obfd);
@@ -1548,38 +1583,74 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
   Elf_Internal_Ehdr *ehdr;
   const struct elf_backend_data *bed;
   const char *name;
+  bfd_boolean ret = TRUE;
+  static bfd_boolean * sections_being_created = NULL;
+  static bfd * sections_being_created_abfd = NULL;
+  static unsigned int nesting = 0;
 
   if (shindex >= elf_numsections (abfd))
     return FALSE;
 
+  if (++ nesting > 3)
+    {
+      /* PR17512: A corrupt ELF binary might contain a recursive group of
+        sections, each the string indicies pointing to the next in the
+        loop.  Detect this here, by refusing to load a section that we are
+        already in the process of loading.  We only trigger this test if
+        we have nested at least three sections deep as normal ELF binaries
+        can expect to recurse at least once.
+
+        FIXME: It would be better if this array was attached to the bfd,
+        rather than being held in a static pointer.  */
+
+      if (sections_being_created_abfd != abfd)
+       sections_being_created = NULL;
+      if (sections_being_created == NULL)
+       {
+         /* FIXME: It would be more efficient to attach this array to the bfd somehow.  */
+         sections_being_created = (bfd_boolean *)
+           bfd_zalloc (abfd, elf_numsections (abfd) * sizeof (bfd_boolean));
+         sections_being_created_abfd = abfd;
+       }
+      if (sections_being_created [shindex])
+       {
+         (*_bfd_error_handler)
+           (_("%B: warning: loop in section dependencies detected"), abfd);
+         return FALSE;
+       }
+      sections_being_created [shindex] = TRUE;
+    }
+
   hdr = elf_elfsections (abfd)[shindex];
   ehdr = elf_elfheader (abfd);
   name = bfd_elf_string_from_elf_section (abfd, ehdr->e_shstrndx,
                                          hdr->sh_name);
   if (name == NULL)
-    return FALSE;
+    goto fail;
 
   bed = get_elf_backend_data (abfd);
   switch (hdr->sh_type)
     {
     case SHT_NULL:
       /* Inactive section. Throw it away.  */
-      return TRUE;
+      goto success;
 
-    case SHT_PROGBITS: /* Normal section with contents.  */
-    case SHT_NOBITS:   /* .bss section.  */
-    case SHT_HASH:     /* .hash section.  */
-    case SHT_NOTE:     /* .note section.  */
+    case SHT_PROGBITS:         /* Normal section with contents.  */
+    case SHT_NOBITS:           /* .bss section.  */
+    case SHT_HASH:             /* .hash section.  */
+    case SHT_NOTE:             /* .note section.  */
     case SHT_INIT_ARRAY:       /* .init_array section.  */
     case SHT_FINI_ARRAY:       /* .fini_array section.  */
     case SHT_PREINIT_ARRAY:    /* .preinit_array section.  */
     case SHT_GNU_LIBLIST:      /* .gnu.liblist section.  */
     case SHT_GNU_HASH:         /* .gnu.hash section.  */
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
     case SHT_DYNAMIC:  /* Dynamic linking information.  */
       if (! _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex))
-       return FALSE;
+       goto fail;
+
       if (hdr->sh_link > elf_numsections (abfd))
        {
          /* PR 10478: Accept Solaris binaries with a sh_link
@@ -1593,11 +1664,11 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                break;
              /* Otherwise fall through.  */
            default:
-             return FALSE;
+             goto fail;
            }
        }
       else if (elf_elfsections (abfd)[hdr->sh_link] == NULL)
-       return FALSE;
+       goto fail;
       else if (elf_elfsections (abfd)[hdr->sh_link]->sh_type != SHT_STRTAB)
        {
          Elf_Internal_Shdr *dynsymhdr;
@@ -1626,24 +1697,26 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                }
            }
        }
-      break;
+      goto success;
 
-    case SHT_SYMTAB:           /* A symbol table */
+    case SHT_SYMTAB:           /* A symbol table */
       if (elf_onesymtab (abfd) == shindex)
-       return TRUE;
+       goto success;
 
       if (hdr->sh_entsize != bed->s->sizeof_sym)
-       return FALSE;
+       goto fail;
+
       if (hdr->sh_info * hdr->sh_entsize > hdr->sh_size)
        {
          if (hdr->sh_size != 0)
-           return FALSE;
+           goto fail;
          /* Some assemblers erroneously set sh_info to one with a
             zero sh_size.  ld sees this as a global symbol count
             of (unsigned) -1.  Fix it here.  */
          hdr->sh_info = 0;
-         return TRUE;
+         goto success;
        }
+
       BFD_ASSERT (elf_onesymtab (abfd) == 0);
       elf_onesymtab (abfd) = shindex;
       elf_tdata (abfd)->symtab_hdr = *hdr;
@@ -1660,7 +1733,7 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
          && (abfd->flags & DYNAMIC) != 0
          && ! _bfd_elf_make_section_from_shdr (abfd, hdr, name,
                                                shindex))
-       return FALSE;
+       goto fail;
 
       /* Go looking for SHT_SYMTAB_SHNDX too, since if there is one we
         can't read symbols without that section loaded as well.  It
@@ -1686,26 +1759,29 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                  break;
              }
          if (i != shindex)
-           return bfd_section_from_shdr (abfd, i);
+           ret = bfd_section_from_shdr (abfd, i);
        }
-      return TRUE;
+      goto success;
 
-    case SHT_DYNSYM:           /* A dynamic symbol table */
+    case SHT_DYNSYM:           /* A dynamic symbol table */
       if (elf_dynsymtab (abfd) == shindex)
-       return TRUE;
+       goto success;
 
       if (hdr->sh_entsize != bed->s->sizeof_sym)
-       return FALSE;
+       goto fail;
+
       if (hdr->sh_info * hdr->sh_entsize > hdr->sh_size)
        {
          if (hdr->sh_size != 0)
-           return FALSE;
+           goto fail;
+
          /* Some linkers erroneously set sh_info to one with a
             zero sh_size.  ld sees this as a global symbol count
             of (unsigned) -1.  Fix it here.  */
          hdr->sh_info = 0;
-         return TRUE;
+         goto success;
        }
+
       BFD_ASSERT (elf_dynsymtab (abfd) == 0);
       elf_dynsymtab (abfd) = shindex;
       elf_tdata (abfd)->dynsymtab_hdr = *hdr;
@@ -1714,34 +1790,38 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
 
       /* Besides being a symbol table, we also treat this as a regular
         section, so that objcopy can handle it.  */
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
-    case SHT_SYMTAB_SHNDX:     /* Symbol section indices when >64k sections */
+    case SHT_SYMTAB_SHNDX:     /* Symbol section indices when >64k sections */
       if (elf_symtab_shndx (abfd) == shindex)
-       return TRUE;
+       goto success;
 
       BFD_ASSERT (elf_symtab_shndx (abfd) == 0);
       elf_symtab_shndx (abfd) = shindex;
       elf_tdata (abfd)->symtab_shndx_hdr = *hdr;
       elf_elfsections (abfd)[shindex] = &elf_tdata (abfd)->symtab_shndx_hdr;
-      return TRUE;
+      goto success;
 
-    case SHT_STRTAB:           /* A string table */
+    case SHT_STRTAB:           /* A string table */
       if (hdr->bfd_section != NULL)
-       return TRUE;
+       goto success;
+
       if (ehdr->e_shstrndx == shindex)
        {
          elf_tdata (abfd)->shstrtab_hdr = *hdr;
          elf_elfsections (abfd)[shindex] = &elf_tdata (abfd)->shstrtab_hdr;
-         return TRUE;
+         goto success;
        }
+
       if (elf_elfsections (abfd)[elf_onesymtab (abfd)]->sh_link == shindex)
        {
        symtab_strtab:
          elf_tdata (abfd)->strtab_hdr = *hdr;
          elf_elfsections (abfd)[shindex] = &elf_tdata (abfd)->strtab_hdr;
-         return TRUE;
+         goto success;
        }
+
       if (elf_elfsections (abfd)[elf_dynsymtab (abfd)]->sh_link == shindex)
        {
        dynsymtab_strtab:
@@ -1750,8 +1830,9 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
          elf_elfsections (abfd)[shindex] = hdr;
          /* We also treat this as a regular section, so that objcopy
             can handle it.  */
-         return _bfd_elf_make_section_from_shdr (abfd, hdr, name,
-                                                 shindex);
+         ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name,
+                                                shindex);
+         goto success;
        }
 
       /* If the string table isn't one of the above, then treat it as a
@@ -1769,9 +1850,9 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                {
                  /* Prevent endless recursion on broken objects.  */
                  if (i == shindex)
-                   return FALSE;
+                   goto fail;
                  if (! bfd_section_from_shdr (abfd, i))
-                   return FALSE;
+                   goto fail;
                  if (elf_onesymtab (abfd) == i)
                    goto symtab_strtab;
                  if (elf_dynsymtab (abfd) == i)
@@ -1779,7 +1860,8 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                }
            }
        }
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
     case SHT_REL:
     case SHT_RELA:
@@ -1794,7 +1876,7 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
        if (hdr->sh_entsize
            != (bfd_size_type) (hdr->sh_type == SHT_REL
                                ? bed->s->sizeof_rel : bed->s->sizeof_rela))
-         return FALSE;
+         goto fail;
 
        /* Check for a bogus link to avoid crashing.  */
        if (hdr->sh_link >= num_sec)
@@ -1802,8 +1884,9 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
            ((*_bfd_error_handler)
             (_("%B: invalid link %lu for reloc section %s (index %u)"),
              abfd, hdr->sh_link, name, shindex));
-           return _bfd_elf_make_section_from_shdr (abfd, hdr, name,
-                                                   shindex);
+           ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name,
+                                                  shindex);
+           goto success;
          }
 
        /* For some incomprehensible reason Oracle distributes
@@ -1844,7 +1927,7 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
        if ((elf_elfsections (abfd)[hdr->sh_link]->sh_type == SHT_SYMTAB
             || elf_elfsections (abfd)[hdr->sh_link]->sh_type == SHT_DYNSYM)
            && ! bfd_section_from_shdr (abfd, hdr->sh_link))
-         return FALSE;
+         goto fail;
 
        /* If this reloc section does not use the main symbol table we
           don't treat it as a reloc section.  BFD can't adequately
@@ -1859,14 +1942,18 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
            || hdr->sh_info >= num_sec
            || elf_elfsections (abfd)[hdr->sh_info]->sh_type == SHT_REL
            || elf_elfsections (abfd)[hdr->sh_info]->sh_type == SHT_RELA)
-         return _bfd_elf_make_section_from_shdr (abfd, hdr, name,
-                                                 shindex);
+         {
+           ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name,
+                                                  shindex);
+           goto success;
+         }
 
        if (! bfd_section_from_shdr (abfd, hdr->sh_info))
-         return FALSE;
+         goto fail;
+
        target_sect = bfd_section_from_elf_index (abfd, hdr->sh_info);
        if (target_sect == NULL)
-         return FALSE;
+         goto fail;
 
        esdt = elf_section_data (target_sect);
        if (hdr->sh_type == SHT_RELA)
@@ -1878,7 +1965,7 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
        amt = sizeof (*hdr2);
        hdr2 = (Elf_Internal_Shdr *) bfd_alloc (abfd, amt);
        if (hdr2 == NULL)
-         return FALSE;
+         goto fail;
        *hdr2 = *hdr;
        *p_hdr = hdr2;
        elf_elfsections (abfd)[shindex] = hdr2;
@@ -1894,34 +1981,40 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
              target_sect->use_rela_p = 1;
          }
        abfd->flags |= HAS_RELOC;
-       return TRUE;
+       goto success;
       }
 
     case SHT_GNU_verdef:
       elf_dynverdef (abfd) = shindex;
       elf_tdata (abfd)->dynverdef_hdr = *hdr;
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
     case SHT_GNU_versym:
       if (hdr->sh_entsize != sizeof (Elf_External_Versym))
-       return FALSE;
+       goto fail;
+
       elf_dynversym (abfd) = shindex;
       elf_tdata (abfd)->dynversym_hdr = *hdr;
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
     case SHT_GNU_verneed:
       elf_dynverref (abfd) = shindex;
       elf_tdata (abfd)->dynverref_hdr = *hdr;
-      return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+      goto success;
 
     case SHT_SHLIB:
-      return TRUE;
+      goto success;
 
     case SHT_GROUP:
       if (! IS_VALID_GROUP_SECTION_HEADER (hdr, GRP_ENTRY_SIZE))
-       return FALSE;
+       goto fail;
+
       if (!_bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex))
-       return FALSE;
+       goto fail;
+
       if (hdr->contents != NULL)
        {
          Elf_Internal_Group *idx = (Elf_Internal_Group *) hdr->contents;
@@ -1947,7 +2040,7 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                }
            }
        }
-      break;
+      goto success;
 
     default:
       /* Possibly an attributes section.  */
@@ -1955,14 +2048,14 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
          || hdr->sh_type == bed->obj_attrs_section_type)
        {
          if (! _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex))
-           return FALSE;
+           goto fail;
          _bfd_elf_parse_attributes (abfd, hdr);
-         return TRUE;
+         goto success;
        }
 
       /* Check for any processor-specific section types.  */
       if (bed->elf_backend_section_from_shdr (abfd, hdr, name, shindex))
-       return TRUE;
+       goto success;
 
       if (hdr->sh_type >= SHT_LOUSER && hdr->sh_type <= SHT_HIUSER)
        {
@@ -1974,9 +2067,12 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                 "specific section `%s' [0x%8x]"),
               abfd, name, hdr->sh_type);
          else
-           /* Allow sections reserved for applications.  */
-           return _bfd_elf_make_section_from_shdr (abfd, hdr, name,
-                                                   shindex);
+           {
+             /* Allow sections reserved for applications.  */
+             ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name,
+                                                    shindex);
+             goto success;
+           }
        }
       else if (hdr->sh_type >= SHT_LOPROC
               && hdr->sh_type <= SHT_HIPROC)
@@ -1997,8 +2093,11 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
                 "`%s' [0x%8x]"),
               abfd, name, hdr->sh_type);
          else
-           /* Otherwise it should be processed.  */
-           return _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+           {
+             /* Otherwise it should be processed.  */
+             ret = _bfd_elf_make_section_from_shdr (abfd, hdr, name, shindex);
+             goto success;
+           }
        }
       else
        /* FIXME: We should handle this section.  */
@@ -2006,10 +2105,20 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
          (_("%B: don't know how to handle section `%s' [0x%8x]"),
           abfd, name, hdr->sh_type);
 
-      return FALSE;
+      goto fail;
     }
 
-  return TRUE;
+ fail:
+  ret = FALSE;
+ success:
+  if (sections_being_created && sections_being_created_abfd == abfd)
+    sections_being_created [shindex] = FALSE;
+  if (-- nesting == 0)
+    {
+      sections_being_created = NULL;
+      sections_being_created_abfd = abfd;
+    }
+  return ret;
 }
 
 /* Return the local symbol specified by ABFD, R_SYMNDX.  */
@@ -3071,11 +3180,13 @@ assign_section_numbers (bfd *abfd, struct bfd_link_info *link_info)
        {
          d->rel.hdr->sh_link = elf_onesymtab (abfd);
          d->rel.hdr->sh_info = d->this_idx;
+         d->rel.hdr->sh_flags |= SHF_INFO_LINK;
        }
       if (d->rela.idx != 0)
        {
          d->rela.hdr->sh_link = elf_onesymtab (abfd);
          d->rela.hdr->sh_info = d->this_idx;
+         d->rela.hdr->sh_flags |= SHF_INFO_LINK;
        }
 
       /* We need to set up sh_link for SHF_LINK_ORDER.  */
@@ -3162,7 +3273,10 @@ assign_section_numbers (bfd *abfd, struct bfd_link_info *link_info)
            name += 5;
          s = bfd_get_section_by_name (abfd, name);
          if (s != NULL)
-           d->this_hdr.sh_info = elf_section_data (s)->this_idx;
+           {
+             d->this_hdr.sh_info = elf_section_data (s)->this_idx;
+             d->this_hdr.sh_flags |= SHF_INFO_LINK;
+           }
          break;
 
        case SHT_STRTAB:
@@ -3453,8 +3567,7 @@ _bfd_elf_compute_section_file_positions (bfd *abfd,
     return FALSE;
 
   /* Post process the headers if necessary.  */
-  if (bed->elf_backend_post_process_headers)
-    (*bed->elf_backend_post_process_headers) (abfd, link_info);
+  (*bed->elf_backend_post_process_headers) (abfd, link_info);
 
   fsargs.failed = FALSE;
   fsargs.link_info = link_info;
@@ -4109,11 +4222,31 @@ _bfd_elf_map_sections_to_segments (bfd *abfd, struct bfd_link_info *info)
          /* Mandated PF_R.  */
          m->p_flags = PF_R;
          m->p_flags_valid = 1;
+         s = first_tls;
          for (i = 0; i < (unsigned int) tls_count; ++i)
            {
-             BFD_ASSERT (first_tls->flags & SEC_THREAD_LOCAL);
-             m->sections[i] = first_tls;
-             first_tls = first_tls->next;
+             if ((s->flags & SEC_THREAD_LOCAL) == 0)
+               {
+                 _bfd_error_handler
+                   (_("%B: TLS sections are not adjacent:"), abfd);
+                 s = first_tls;
+                 i = 0;
+                 while (i < (unsigned int) tls_count)
+                   {
+                     if ((s->flags & SEC_THREAD_LOCAL) != 0)
+                       {
+                         _bfd_error_handler (_("           TLS: %A"), s);
+                         i++;
+                       }
+                     else
+                       _bfd_error_handler (_(" non-TLS: %A"), s);
+                     s = s->next;
+                   }
+                 bfd_set_error (bfd_error_bad_value);
+                 goto error_return;
+               }
+             m->sections[i] = s;
+             s = s->next;
            }
 
          *pm = m;
@@ -4176,11 +4309,7 @@ _bfd_elf_map_sections_to_segments (bfd *abfd, struct bfd_link_info *info)
                        == (SEC_LOAD | SEC_HAS_CONTENTS))
                      break;
 
-                 if (i == (unsigned) -1)
-                   continue;
-
-                 if (m->sections[i]->vma + m->sections[i]->size
-                     >= info->relro_end)
+                 if (i != (unsigned) -1)
                    break;
                }
            }
@@ -4305,6 +4434,9 @@ elf_sort_sections (const void *arg1, const void *arg2)
 static file_ptr
 vma_page_aligned_bias (bfd_vma vma, ufile_ptr off, bfd_vma maxpagesize)
 {
+  /* PR binutils/16199: Handle an alignment of zero.  */
+  if (maxpagesize == 0)
+    maxpagesize = 1;
   return ((vma - off) % maxpagesize);
 }
 
@@ -4781,6 +4913,7 @@ assign_file_positions_for_load_sections (bfd *abfd,
                p->p_flags |= PF_W;
            }
        }
+
       off -= off_adjust;
 
       /* Check that all sections are in a PT_LOAD segment.
@@ -4982,14 +5115,11 @@ assign_file_positions_for_non_load_sections (bfd *abfd,
                {
                  if (lp->p_type == PT_LOAD
                      && lp->p_vaddr < link_info->relro_end
-                     && lp->p_vaddr + lp->p_filesz >= link_info->relro_end
                      && lm->count != 0
                      && lm->sections[0]->vma >= link_info->relro_start)
                    break;
                }
 
-             /* PR ld/14207.  If the RELRO segment doesn't fit in the
-                LOAD segment, it should be removed.  */
              BFD_ASSERT (lm != NULL);
            }
          else
@@ -5099,7 +5229,6 @@ assign_file_positions_except_relocs (bfd *abfd,
 {
   struct elf_obj_tdata *tdata = elf_tdata (abfd);
   Elf_Internal_Ehdr *i_ehdrp = elf_elfheader (abfd);
-  file_ptr off;
   const struct elf_backend_data *bed = get_elf_backend_data (abfd);
 
   if ((abfd->flags & (EXEC_P | DYNAMIC)) == 0
@@ -5109,6 +5238,7 @@ assign_file_positions_except_relocs (bfd *abfd,
       unsigned int num_sec = elf_numsections (abfd);
       Elf_Internal_Shdr **hdrpp;
       unsigned int i;
+      file_ptr off;
 
       /* Start after the ELF header.  */
       off = i_ehdrp->e_ehsize;
@@ -5132,6 +5262,8 @@ assign_file_positions_except_relocs (bfd *abfd,
          else
            off = _bfd_elf_assign_file_position_for_section (hdr, off, TRUE);
        }
+
+      elf_next_file_pos (abfd) = off;
     }
   else
     {
@@ -5152,22 +5284,34 @@ assign_file_positions_except_relocs (bfd *abfd,
            return FALSE;
        }
 
+      /* Set e_type in ELF header to ET_EXEC for -pie -Ttext-segment=.  */
+      if (link_info != NULL
+         && link_info->executable
+         && link_info->shared)
+       {
+         unsigned int num_segments = elf_elfheader (abfd)->e_phnum;
+         Elf_Internal_Phdr *segment = elf_tdata (abfd)->phdr;
+         Elf_Internal_Phdr *end_segment = &segment[num_segments];
+
+         /* Find the lowest p_vaddr in PT_LOAD segments.  */
+         bfd_vma p_vaddr = (bfd_vma) -1;
+         for (; segment < end_segment; segment++)
+           if (segment->p_type == PT_LOAD && p_vaddr > segment->p_vaddr)
+             p_vaddr = segment->p_vaddr;
+
+         /* Set e_type to ET_EXEC if the lowest p_vaddr in PT_LOAD
+            segments is non-zero.  */
+         if (p_vaddr)
+           i_ehdrp->e_type = ET_EXEC;
+       }
+
       /* Write out the program headers.  */
       alloc = elf_program_header_size (abfd) / bed->s->sizeof_phdr;
       if (bfd_seek (abfd, (bfd_signed_vma) bed->s->sizeof_ehdr, SEEK_SET) != 0
          || bed->s->write_out_phdrs (abfd, tdata->phdr, alloc) != 0)
        return FALSE;
-
-      off = elf_next_file_pos (abfd);
     }
 
-  /* Place the section headers.  */
-  off = align_file_position (off, 1 << bed->s->log_file_align);
-  i_ehdrp->e_shoff = off;
-  off += i_ehdrp->e_shnum * i_ehdrp->e_shentsize;
-
-  elf_next_file_pos (abfd) = off;
-
   return TRUE;
 }
 
@@ -5252,7 +5396,7 @@ prep_headers (bfd *abfd)
   elf_tdata (abfd)->shstrtab_hdr.sh_name =
     (unsigned int) _bfd_elf_strtab_add (shstrtab, ".shstrtab", FALSE);
   if (elf_tdata (abfd)->symtab_hdr.sh_name == (unsigned int) -1
-      || elf_tdata (abfd)->symtab_hdr.sh_name == (unsigned int) -1
+      || elf_tdata (abfd)->strtab_hdr.sh_name == (unsigned int) -1
       || elf_tdata (abfd)->shstrtab_hdr.sh_name == (unsigned int) -1)
     return FALSE;
 
@@ -5260,14 +5404,16 @@ prep_headers (bfd *abfd)
 }
 
 /* Assign file positions for all the reloc sections which are not part
-   of the loadable file image.  */
+   of the loadable file image, and the file position of section headers.  */
 
-void
+static void
 _bfd_elf_assign_file_positions_for_relocs (bfd *abfd)
 {
   file_ptr off;
   unsigned int i, num_sec;
   Elf_Internal_Shdr **shdrpp;
+  Elf_Internal_Ehdr *i_ehdrp;
+  const struct elf_backend_data *bed;
 
   off = elf_next_file_pos (abfd);
 
@@ -5282,6 +5428,12 @@ _bfd_elf_assign_file_positions_for_relocs (bfd *abfd)
        off = _bfd_elf_assign_file_position_for_section (shdrp, off, TRUE);
     }
 
+/* Place the section headers.  */
+  i_ehdrp = elf_elfheader (abfd);
+  bed = get_elf_backend_data (abfd);
+  off = align_file_position (off, 1 << bed->s->log_file_align);
+  i_ehdrp->e_shoff = off;
+  off += i_ehdrp->e_shnum * i_ehdrp->e_shentsize;
   elf_next_file_pos (abfd) = off;
 }
 
@@ -6213,7 +6365,7 @@ copy_elf_program_header (bfd *ibfd, bfd *obfd)
            phdr_included = TRUE;
        }
 
-      lowest_section = first_section;
+      lowest_section = NULL;
       if (section_count != 0)
        {
          unsigned int isec = 0;
@@ -6226,12 +6378,14 @@ copy_elf_program_header (bfd *ibfd, bfd *obfd)
              if (ELF_SECTION_IN_SEGMENT (this_hdr, segment))
                {
                  map->sections[isec++] = section->output_section;
-                 if (section->lma < lowest_section->lma)
-                   lowest_section = section;
                  if ((section->flags & SEC_ALLOC) != 0)
                    {
                      bfd_vma seg_off;
 
+                     if (lowest_section == NULL
+                         || section->lma < lowest_section->lma)
+                       lowest_section = section;
+
                      /* Section lmas are set up from PT_LOAD header
                         p_paddr in _bfd_elf_make_section_from_shdr.
                         If this header has a p_paddr that disagrees
@@ -7500,8 +7654,8 @@ _bfd_elf_set_arch_mach (bfd *abfd,
 
 static bfd_boolean
 elf_find_function (bfd *abfd,
-                  asection *section,
                   asymbol **symbols,
+                  asection *section,
                   bfd_vma offset,
                   const char **filename_ptr,
                   const char **functionname_ptr)
@@ -7603,52 +7757,35 @@ elf_find_function (bfd *abfd,
 
 bfd_boolean
 _bfd_elf_find_nearest_line (bfd *abfd,
-                           asection *section,
                            asymbol **symbols,
+                           asection *section,
                            bfd_vma offset,
                            const char **filename_ptr,
                            const char **functionname_ptr,
-                           unsigned int *line_ptr)
-{
-  return _bfd_elf_find_nearest_line_discriminator (abfd, section, symbols,
-                                                   offset, filename_ptr,
-                                                   functionname_ptr,
-                                                   line_ptr,
-                                                   NULL);
-}
-
-bfd_boolean
-_bfd_elf_find_nearest_line_discriminator (bfd *abfd,
-                                          asection *section,
-                                          asymbol **symbols,
-                                          bfd_vma offset,
-                                          const char **filename_ptr,
-                                          const char **functionname_ptr,
-                                          unsigned int *line_ptr,
-                                          unsigned int *discriminator_ptr)
+                           unsigned int *line_ptr,
+                           unsigned int *discriminator_ptr)
 {
   bfd_boolean found;
 
-  if (_bfd_dwarf1_find_nearest_line (abfd, section, symbols, offset,
+  if (_bfd_dwarf2_find_nearest_line (abfd, symbols, NULL, section, offset,
                                     filename_ptr, functionname_ptr,
-                                    line_ptr))
+                                    line_ptr, discriminator_ptr,
+                                    dwarf_debug_sections, 0,
+                                    &elf_tdata (abfd)->dwarf2_find_line_info))
     {
       if (!*functionname_ptr)
-       elf_find_function (abfd, section, symbols, offset,
+       elf_find_function (abfd, symbols, section, offset,
                           *filename_ptr ? NULL : filename_ptr,
                           functionname_ptr);
 
       return TRUE;
     }
 
-  if (_bfd_dwarf2_find_nearest_line (abfd, dwarf_debug_sections,
-                                     section, symbols, offset,
-                                    filename_ptr, functionname_ptr,
-                                    line_ptr, discriminator_ptr, 0,
-                                    &elf_tdata (abfd)->dwarf2_find_line_info))
+  if (_bfd_dwarf1_find_nearest_line (abfd, symbols, section, offset,
+                                    filename_ptr, functionname_ptr, line_ptr))
     {
       if (!*functionname_ptr)
-       elf_find_function (abfd, section, symbols, offset,
+       elf_find_function (abfd, symbols, section, offset,
                           *filename_ptr ? NULL : filename_ptr,
                           functionname_ptr);
 
@@ -7666,7 +7803,7 @@ _bfd_elf_find_nearest_line_discriminator (bfd *abfd,
   if (symbols == NULL)
     return FALSE;
 
-  if (! elf_find_function (abfd, section, symbols, offset,
+  if (! elf_find_function (abfd, symbols, section, offset,
                           filename_ptr, functionname_ptr))
     return FALSE;
 
@@ -7680,20 +7817,10 @@ bfd_boolean
 _bfd_elf_find_line (bfd *abfd, asymbol **symbols, asymbol *symbol,
                    const char **filename_ptr, unsigned int *line_ptr)
 {
-  return _bfd_elf_find_line_discriminator (abfd, symbols, symbol,
-                                          filename_ptr, line_ptr,
-                                           NULL);
-}
-
-bfd_boolean
-_bfd_elf_find_line_discriminator (bfd *abfd, asymbol **symbols, asymbol *symbol,
-                                  const char **filename_ptr,
-                                  unsigned int *line_ptr,
-                                  unsigned int *discriminator_ptr)
-{
-  return _bfd_dwarf2_find_line (abfd, symbols, symbol,
-                               filename_ptr, line_ptr, discriminator_ptr, 0,
-                               &elf_tdata (abfd)->dwarf2_find_line_info);
+  return _bfd_dwarf2_find_nearest_line (abfd, symbols, symbol, NULL, 0,
+                                       filename_ptr, NULL, line_ptr, NULL,
+                                       dwarf_debug_sections, 0,
+                                       &elf_tdata (abfd)->dwarf2_find_line_info);
 }
 
 /* After a call to bfd_find_nearest_line, successive calls to
@@ -7752,7 +7879,7 @@ _bfd_elf_set_section_contents (bfd *abfd,
                               bfd_size_type count)
 {
   Elf_Internal_Shdr *hdr;
-  bfd_signed_vma pos;
+  file_ptr pos;
 
   if (! abfd->output_has_begun
       && ! _bfd_elf_compute_section_file_positions (abfd, NULL))
@@ -9286,7 +9413,7 @@ elfcore_write_lwpstatus (bfd *abfd,
   lwpstat.pr_lwpid  = pid >> 16;
   lwpstat.pr_cursig = cursig;
 #if defined (HAVE_LWPSTATUS_T_PR_REG)
-  memcpy (lwpstat.pr_reg, gregs, sizeof (lwpstat.pr_reg));
+  memcpy (&lwpstat.pr_reg, gregs, sizeof (lwpstat.pr_reg));
 #elif defined (HAVE_LWPSTATUS_T_PR_CONTEXT)
 #if !defined(gregs)
   memcpy (lwpstat.pr_context.uc_mcontext.gregs,
@@ -9860,11 +9987,12 @@ bfd *
 bfd_elf_bfd_from_remote_memory
   (bfd *templ,
    bfd_vma ehdr_vma,
+   bfd_size_type size,
    bfd_vma *loadbasep,
    int (*target_read_memory) (bfd_vma, bfd_byte *, bfd_size_type))
 {
   return (*get_elf_backend_data (templ)->elf_backend_bfd_from_remote_memory)
-    (templ, ehdr_vma, loadbasep, target_read_memory);
+    (templ, ehdr_vma, size, loadbasep, target_read_memory);
 }
 \f
 long
@@ -9990,8 +10118,8 @@ asection _bfd_elf_large_com_section
                      SEC_IS_COMMON, NULL, "LARGE_COMMON", 0);
 
 void
-_bfd_elf_set_osabi (bfd * abfd,
-                   struct bfd_link_info * link_info ATTRIBUTE_UNUSED)
+_bfd_elf_post_process_headers (bfd * abfd,
+                              struct bfd_link_info * link_info ATTRIBUTE_UNUSED)
 {
   Elf_Internal_Ehdr * i_ehdrp; /* ELF file header, internal form.  */