From 116acb2c268c89c89186673a7c92620d21825b25 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Wed, 28 Feb 2018 22:09:50 +1030 Subject: [PATCH] PR22887, null pointer dereference in aout_32_swap_std_reloc_out PR 22887 * aoutx.h (swap_std_reloc_in): Correct r_index bound check. Upstream-Status: Backport Affects: <= 2.30 CVE: CVE-2018-7642 Signed-off-by: Armin Kuster --- bfd/ChangeLog | 5 +++++ bfd/aoutx.h | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) Index: git/bfd/ChangeLog =================================================================== --- git.orig/bfd/ChangeLog +++ git/bfd/ChangeLog @@ -1,3 +1,8 @@ +2018-02-28 Alan Modra + + PR 22887 + * aoutx.h (swap_std_reloc_in): Correct r_index bound check. + 2018-02-28 Nick Clifton PR 22895 Index: git/bfd/aoutx.h =================================================================== --- git.orig/bfd/aoutx.h +++ git/bfd/aoutx.h @@ -2211,10 +2211,12 @@ NAME (aout, swap_ext_reloc_in) (bfd *abf || r_type == (unsigned int) RELOC_BASE22) r_extern = 1; - if (r_extern && r_index > symcount) + if (r_extern && r_index >= symcount) { /* We could arrange to return an error, but it might be useful - to see the file even if it is bad. */ + to see the file even if it is bad. FIXME: Of course this + means that objdump -r *doesn't* see the actual reloc, and + objcopy silently writes a different reloc. */ r_extern = 0; r_index = N_ABS; }