From d4d66eb19fd5ace50e1d40f53f14e76fe8b8963d Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Sun, 9 Feb 2025 15:13:38 +0800 Subject: [PATCH] x86: Return error for invalid relocation offset Return error if relocation offset + relocation size > section size. bfd/ PR ld/32665 * elf32-i386.c (elf_i386_scan_relocs): Return error for invalid relocation offset. * elf64-x86-64.c (elf_x86_64_scan_relocs): Likewise. ld/ PR ld/32665 * testsuite/ld-x86-64/pr32665.err: New file. * testsuite/ld-x86-64/pr32665.o.bz2: Likewise. * testsuite/ld-x86-64/x86-64.exp: Run PR ld/32665 test. Signed-off-by: H.J. Lu --- bfd/elf32-i386.c | 12 ++++++++++++ bfd/elf64-x86-64.c | 12 ++++++++++++ ld/testsuite/ld-x86-64/pr32665.err | 3 +++ ld/testsuite/ld-x86-64/pr32665.o.bz2 | Bin 0 -> 2827 bytes ld/testsuite/ld-x86-64/x86-64.exp | 5 +++++ 5 files changed, 32 insertions(+) create mode 100644 ld/testsuite/ld-x86-64/pr32665.err create mode 100644 ld/testsuite/ld-x86-64/pr32665.o.bz2 diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c index 81301bf3a57..701cb6d5473 100644 --- a/bfd/elf32-i386.c +++ b/bfd/elf32-i386.c @@ -1531,6 +1531,7 @@ elf_i386_scan_relocs (bfd *abfd, const char *name; bool size_reloc; bool no_dynreloc; + reloc_howto_type *howto; r_symndx = ELF32_R_SYM (rel->r_info); r_type = ELF32_R_TYPE (rel->r_info); @@ -1547,6 +1548,17 @@ elf_i386_scan_relocs (bfd *abfd, goto error_return; } + howto = elf_i386_rtype_to_howto (r_type); + if (rel->r_offset + bfd_get_reloc_size (howto) > sec->size) + { + /* xgettext:c-format */ + _bfd_error_handler + (_("%pB: bad reloc offset (%#" PRIx32 " > %#" PRIx32 ") for" + " section `%pA'"), abfd, (uint32_t) rel->r_offset, + (uint32_t) sec->size, sec); + goto error_return; + } + if (r_symndx < symtab_hdr->sh_info) { /* A local symbol. */ diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c index bb42ed5bd63..feb8827b3c1 100644 --- a/bfd/elf64-x86-64.c +++ b/bfd/elf64-x86-64.c @@ -2441,6 +2441,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info, bool size_reloc; bool converted_reloc; bool no_dynreloc; + reloc_howto_type *howto; r_symndx = htab->r_sym (rel->r_info); r_type = ELF32_R_TYPE (rel->r_info); @@ -2457,6 +2458,17 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info, goto error_return; } + howto = elf_x86_64_rtype_to_howto (abfd, r_type); + if (rel->r_offset + bfd_get_reloc_size (howto) > sec->size) + { + /* xgettext:c-format */ + _bfd_error_handler + (_("%pB: bad reloc offset (%#" PRIx64 " > %#" PRIx64 ") for" + " section `%pA'"), abfd, (uint64_t) rel->r_offset, + (uint64_t) sec->size, sec); + goto error_return; + } + if (r_symndx < symtab_hdr->sh_info) { /* A local symbol. */ diff --git a/ld/testsuite/ld-x86-64/pr32665.err b/ld/testsuite/ld-x86-64/pr32665.err new file mode 100644 index 00000000000..f539eb07433 --- /dev/null +++ b/ld/testsuite/ld-x86-64/pr32665.err @@ -0,0 +1,3 @@ +#... +.*tmpdir/pr32665.o: bad reloc offset \(0xf2ffffff01bc > 0x574\) for section `.text' +#... diff --git a/ld/testsuite/ld-x86-64/pr32665.o.bz2 b/ld/testsuite/ld-x86-64/pr32665.o.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..42695cb85778379d0b9d468361666d63e3aa9e2c GIT binary patch literal 2827 zc-jFA3-t6tT4*^jL0KkKSueJL82}2wfB*mg|Ly<(|NsC0|26;r|M%X%|Ml$T{#O03 zbMtg;`TyVvm&|JxzzkF<8*QX)kw6<_pwm$SG{lqApQ)OfW}{QeFl|j9r2P{~pk(zA z(M>#&v;s8pjj7}#)byGI$r~sErkV$-`ldr_0s4TSsUD_iLFqQ286Js-NJdQ)6F|`n zqa#fc3hjTH4WL>MO2+MZL>De5+vN2Wm2CQ#a% zJcK~&!B=F5UK zyF)C+h*V)}#nBLEURbgJ)e*>mSr80Xbir3vv}*b8>GrvWzac@gf%!A)GjoK{kYCD*&`UM&pI((O9sA%+`iRiKJs&tDmJ#SQFOJ45*Yw zfd)&;#o^KJx!ci>)YVY+Klbh1TW>5>jY1jR=M|E?WVy6}2WL*A zERUS1+d4@u}tl^BSGh;(X6o1YFTtU6r1pQllTKxmzUxF0HRiU*hx zn}v>pIa~iy_V@e9fy5mWAbkJ|PfVg}Ub`*?f{n2(+etU@->T%&Tvja$H6Cn#F4xl2 zYjSRF_q!h}UH-q#e4PdgJ`67MkSLfbF>V-ZSR~1sNgyYhgyI`O*`{cQFk)@CHpbZW z`j3%)G~Wx^ge#4Xj3xt(sU~rlJv7 za+n(+#}gRFF^ppv$mVCSa3^5b!t-Avt&M9A__mvEw%c&9IvcV_M$odfOZ-ZjDWPM} zxxR+UUdEGRHXm97M^6W}BJ{IyIhJBKH5f(sLDHi65H%8$Gpg~l*S@eoMQmd2aap;Z#0%2%>PG9zJ4YitwuDzemPRA8B6}Q$>Ylv5La zS)}%vh2FNKiKtew>I?6cvFRd=9Wc%drH%z+R`6hl%5@_C$|;_VJ;TC6lhA`7eQdx2 z*_BsUhUPX2C=#X%1g%Tgg9cFTMP%SYSOJEeT%ALjG#(}pvr-_5iSl6us$%lw{mAy3 ze_HSQr!fZY!vdg$Vw)waNsmugPDP4POQs$6+s%triA=b$1xki}YCu=jdr=v5%9x>i za-`qi>Zt^qw<`!u*+-lxH}jBa0yw6mm(I)<5Jgu^g<32Op(K4qZ9c3jk;%lciJV5T zSgx8}=fvyiV`YmhltGDzGIu$wJTNl*jXw{(ngIZSKs5tK@gD!g4Be~85L&wV(0Lk+ zrZuQS?MNMeeiqssAv?iJ!oucm+WHY3Vldt-3+I=O5_vqk_jPC9T*Mois{oCsQ|LXZ5Gv^s)L>`PpR<~+76~jNkpLQ=0olzhp>b8`Gir$XP$`6lD!EqT zWHwo^=G8BDbu)v|YnKuPFUXx_;8oAii6~1_nB}IRZEjy8hJ)4^qO4R6Hra11$&zMP z7Nd33+nWn)Pq`Dp3ahxb7X^hI`$qH00Mc2l}d1oi_Z;?Eqqp}!#TW+ ze5^2=_Z-dI66+L*!6khAMfKGL4#PCAxd_QrA|j!@M55kirgh|8jze;HN<>Ej`Q{MH z=~;9|F>Z3G5DFzy0ETke>sNp{F9Io&hetjtmVzWAzE=NIAsRgxiZ?(nNGhO$$d-A; zM=aK*B?_n!xEx_|fixFQz+z=fm2pZ!AOWe2UNN$gtt{VJj5*haI>U^VgG9GveibIG zF5L~!STvRQ+Shju0037d-uFP1?J%w^A;D@ZiY2|cbrE1Pr6zVEBTmHAI&F+1M&7!v zeTtA34JIZQtrbZinwY37l7WgHH^Qe2iBh0M7h^4GkPT8Pz(VH)K=_}o*JyM)#jSM= zh=MrA!~&%SMrcMbA_=9h1VuGZogNTUd^T`k2W^RXj4=BY?l>zV>ur>y$kcFH5+05298Y;}_`xzt{6CnL~eB(kmJV*dI dd`K5HwuF4)Tk>)*R3P`o+>uTcBn$1J20#q+1t