PR22741, objcopy segfault on fuzzed COFF object

Message ID 20180129052920.GJ20622@bubble.grove.modra.org
State New
Headers show
Series
  • PR22741, objcopy segfault on fuzzed COFF object
Related show

Commit Message

Alan Modra Jan. 29, 2018, 5:29 a.m.
Applying.  auxent tagndx is supposed to be a symbol table index.

	PR 22741
	* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
	range before converting to a symbol table pointer.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index b241087..4f90ead 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -1555,7 +1555,8 @@  coff_pointerize_aux (bfd *abfd,
     }
   /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
      generate one, so we must be careful to ignore it.  */
-  if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+  if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+      < obj_raw_syment_count (abfd))
     {
       auxent->u.auxent.x_sym.x_tagndx.p =
 	table_base + auxent->u.auxent.x_sym.x_tagndx.l;