From patchwork Sun May 24 11:19:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 135520 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id E35BF4B99F67 for ; Sun, 24 May 2026 11:20:29 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E35BF4B99F67 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=bIzBEWa1 X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by sourceware.org (Postfix) with ESMTPS id 313F94B99F69 for ; Sun, 24 May 2026 11:19:44 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 313F94B99F69 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 313F94B99F69 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::42a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1779621584; cv=none; b=BUO2fxkY9vlixLl3USRRsEE1m8xhZgr7QHKz4U1Y3QAWBYGsw7F1hma5W/ox1RzA37C9oUy+SWpa1EKu65QcVHRLno5uREXKHzzg1jvhQ+nzt2gFY99pXQlGEc7dEL5TWla7Qn+gKbP/bvgRy1BZh9VOAnkG32+UGKIBAw89qSQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1779621584; c=relaxed/simple; bh=XpyiiWl2m58dTSA1ai22Q9I+1WCz7GCBIeK2CMrlQlk=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=rfXFDikqkSP5280bECuAjkoIWOVcjeH1jxeV05KqGwy33riRkzZlY8clGDhcCcq5jSTXfpvoMDqIfETy3hufPhxYWaWriwtLJI0IyhBmQ3eEsa/83cIQ1A1REouPF5CSUG8xP34ND92M4PMy5VucFtSnExliR1VqXKjqxBGQiQY= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=bIzBEWa1 DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 313F94B99F69 Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-82fa8d6425bso3991287b3a.0 for ; Sun, 24 May 2026 04:19:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779621583; x=1780226383; darn=sourceware.org; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=26ZuXdGhEIK9iU2vqsRC4EOjroc3X8OCOsNZ+biUds0=; b=bIzBEWa1B7XEAu1zSmMgLv7X5w+n1V1MoULqMFhovwUlV4WOoueXm2Y8JkuPOwYPYj wyJ7/6lsA/CCQS2qrt+xX+VSRb51WFdqeLfXSCUZR4q2FVtzD4Tq3ZxRB/K0ilAkZfM2 ZkoVxwKC4HcGMqdOtckOZ6QgGSOuJ4ji/Jx1Si/4ZGMv0TNZUUYIqg3rYhmfYI/mmRGx HYupH4iZU13Vb6KEe39ofZpdQnpxUdgzXh20rNZA45vUXsWxDfiO8KsBkDf0v5C0kUfX TR76/kKBypKUN3fgEwjSdQpZHACHyJQwwUY/AtO2i4s3TiT8+CHisanIKmarA/NX2sVe 2mNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779621583; x=1780226383; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=26ZuXdGhEIK9iU2vqsRC4EOjroc3X8OCOsNZ+biUds0=; b=j6+yY/4QI7MnU/nyW9Nd+UgBuBk93NqCvVLIzSLKz/cT6xCQr1g6E3hKDjXwDxfsNe RyZXfhrb3kCK043jcKcUgS9IolKg3N2PLIDhUknSUP5/be5p+V67CQ/1GOJIdlQNnYp2 kMY/U0eKDlXbahPqyBkoBeTRqHXW8nyiWxwbMhhyIe7x1USjZ9Hq/MbT7leHUZDucYNW Bui5dcAqI5RTRAY7ZdA2MP2GGUxNgibgweuVXdHDq6sErv5GsC75mO2AdiPzPU6+9kOb YW/JfGOGM0l/UoAsJiUFd8bcuR9uMD6RY0MxMy75MhSi2MiySLxXYd2HdGEsWtdHwADx smyQ== X-Gm-Message-State: AOJu0Ywy0HNHhi1BaYUJfcI1CT/J3+55FCv9YlL+BSXySf/e8X5JEyzQ KAay4usz0afofnguqPEmdPx2Iau9b04PEwAI/x0TBaSE0rDpEjgS9CjD6t0S/g== X-Gm-Gg: Acq92OFFHn7mkcISKXQMgWqtBTkkOwE9d0wYN5DTbaCc3JDmbj4cbO//X36+B76uxby 2wfaS4teWu8vZgPNwEbA91kRdDRLMrEGqI+3Bo0fU1TsW6o19bjEjLsWEYBaazj4BjiFcgusAbq uOVHpDtZ6aInNUW2ALsFfNhjCcEba61JIgxBoFbWtLGg8lBR+jpgi/FyjRJbC8FiA1NRwsm6MR9 rwuK4YCiMjIIXoAxxo/NebVqICnGiy4sIUZabWph9jzNFt9mlS1ltd/g3By7EV4L+iTQwylLwTf jNp0OGhmvgiXvnwqDbPw1PSQoruePPVpmQz/nbYGOrm+HOLs6sqbqz8Rxxn03rOJUfh9t4lAUGP kWBmp9MW35utGeDXCZL6yeR8vnO1GbxN5PoA6bX63K9s0sl0CLCL3eYr3M8locyN1UFKE5/MQ8T /wrmWoH2SDn7yjGXp5NdnUwMwKJKbqxtIoA6R+Xa2VUq8= X-Received: by 2002:a05:6a00:1d9b:b0:837:f79d:909 with SMTP id d2e1a72fcca58-8415f5459f4mr10841161b3a.39.1779621583055; Sun, 24 May 2026 04:19:43 -0700 (PDT) Received: from squeak.grove.modra.org ([58.96.106.158]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84164ac9fa5sm6585807b3a.1.2026.05.24.04.19.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 May 2026 04:19:42 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 8DA561141A4A; Sun, 24 May 2026 20:49:39 +0930 (ACST) Date: Sun, 24 May 2026 20:49:39 +0930 From: Alan Modra To: binutils@sourceware.org Subject: PR 34159, buffer overflow in fr30_elf_i32_reloc Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3030.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Stop the fuzzed object file buffer overflow, and remove a FIXME. * elf32-fr30.c (fr30_elf_i20_reloc, fr30_elf_i32_reloc): Handle ld -r using bfd_elf_generic_reloc. Sanity check reloc offset. diff --git a/bfd/elf32-fr30.c b/bfd/elf32-fr30.c index 1460aed7730..75ec074d23b 100644 --- a/bfd/elf32-fr30.c +++ b/bfd/elf32-fr30.c @@ -238,24 +238,18 @@ fr30_elf_i20_reloc (bfd *abfd, void * data, asection *input_section, bfd *output_bfd, - char **error_message ATTRIBUTE_UNUSED) + char **error_message) { bfd_vma relocation; unsigned long x; - /* This part is from bfd_elf_generic_reloc. */ - if (output_bfd != (bfd *) NULL - && (symbol->flags & BSF_SECTION_SYM) == 0 - && (! reloc_entry->howto->partial_inplace - || reloc_entry->addend == 0)) - { - reloc_entry->address += input_section->output_offset; - return bfd_reloc_ok; - } - if (output_bfd != NULL) - /* FIXME: See bfd_perform_relocation. Is this right? */ - return bfd_reloc_ok; + return bfd_elf_generic_reloc (abfd, reloc_entry, symbol, data, + input_section, output_bfd, error_message); + + if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, + input_section, reloc_entry->address)) + return bfd_reloc_outofrange; relocation = symbol->value @@ -282,23 +276,18 @@ fr30_elf_i32_reloc (bfd *abfd, void * data, asection *input_section, bfd *output_bfd, - char **error_message ATTRIBUTE_UNUSED) + char **error_message) { bfd_vma relocation; - /* This part is from bfd_elf_generic_reloc. */ - if (output_bfd != (bfd *) NULL - && (symbol->flags & BSF_SECTION_SYM) == 0 - && (! reloc_entry->howto->partial_inplace - || reloc_entry->addend == 0)) - { - reloc_entry->address += input_section->output_offset; - return bfd_reloc_ok; - } - if (output_bfd != NULL) - /* FIXME: See bfd_perform_relocation. Is this right? */ - return bfd_reloc_ok; + return bfd_elf_generic_reloc (abfd, reloc_entry, symbol, data, + input_section, output_bfd, error_message); + + if (reloc_entry->address + 2 < 2 + || !bfd_reloc_offset_in_range (reloc_entry->howto, abfd, + input_section, reloc_entry->address + 2)) + return bfd_reloc_outofrange; relocation = symbol->value