buffer overflow in mmix_elf_relocate_section

	* elf64-mmix.c (mmix_elf_relocate_section): Correct size of
	relocs shuffled by memmove.

diff --git a/bfd/elf64-mmix.c b/bfd/elf64-mmix.c
index c377222676d935e3c464804ff0423a4efbee8a77..5bb6feee16eb2b1cea9185e7e272cea1357f9525 100644 (file)
--- a/bfd/elf64-mmix.c
+++ b/bfd/elf64-mmix.c
@@ -1496,7 +1496,7 @@ mmix_elf_relocate_section (bfd *output_bfd ATTRIBUTE_UNUSED,
                  /* Shift this reloc to the end of the relocs to maintain
                     the r_offset sorted reloc order.  */
                  relcpy = *rel;
-                 memmove (rel, rel + 1, (char *) relend - (char *) rel);
+                 memmove (rel, rel + 1, (char *) relend - (char *) (rel + 1));
                  relend[-1] = relcpy;
 
                  /* Back up one reloc, or else we'd skip the next reloc