Fix a memory access violation when attempting to parse a corrupt COFF binary with...

[deliverable/binutils-gdb.git] / bfd / coff-arm.c

diff --git a/bfd/coff-arm.c b/bfd/coff-arm.c
index 8a2fe1a5fb334f89927b9977b043cfa898f218d1..1e66cbcaf8179f7efc3b03f7f7f253ce90726889 100644 (file)
--- a/bfd/coff-arm.c
+++ b/bfd/coff-arm.c
@@ -109,41 +109,46 @@ coff_arm_reloc (bfd *abfd,
   x = ((x & ~howto->dst_mask)                                  \
        | (((x & howto->src_mask) + diff) & howto->dst_mask))
 
-    if (diff != 0)
-      {
-       reloc_howto_type *howto = reloc_entry->howto;
-       unsigned char *addr = (unsigned char *) data + reloc_entry->address;
+  if (diff != 0)
+    {
+      reloc_howto_type *howto = reloc_entry->howto;
+      unsigned char *addr = (unsigned char *) data + reloc_entry->address;
 
-       switch (howto->size)
-         {
-         case 0:
-           {
-             char x = bfd_get_8 (abfd, addr);
-             DOIT (x);
-             bfd_put_8 (abfd, x, addr);
-           }
-           break;
+      if (! bfd_reloc_offset_in_range (howto, abfd, input_section,
+                                      reloc_entry->address
+                                      * bfd_octets_per_byte (abfd)))
+       return bfd_reloc_outofrange;
 
-         case 1:
-           {
-             short x = bfd_get_16 (abfd, addr);
-             DOIT (x);
-             bfd_put_16 (abfd, (bfd_vma) x, addr);
-           }
-           break;
+      switch (howto->size)
+       {
+       case 0:
+         {
+           char x = bfd_get_8 (abfd, addr);
+           DOIT (x);
+           bfd_put_8 (abfd, x, addr);
+         }
+         break;
 
-         case 2:
-           {
-             long x = bfd_get_32 (abfd, addr);
-             DOIT (x);
-             bfd_put_32 (abfd, (bfd_vma) x, addr);
-           }
-           break;
+       case 1:
+         {
+           short x = bfd_get_16 (abfd, addr);
+           DOIT (x);
+           bfd_put_16 (abfd, (bfd_vma) x, addr);
+         }
+         break;
 
-         default:
-           abort ();
+       case 2:
+         {
+           long x = bfd_get_32 (abfd, addr);
+           DOIT (x);
+           bfd_put_32 (abfd, (bfd_vma) x, addr);
          }
-      }
+         break;
+
+       default:
+         abort ();
+       }
+    }
 
   /* Now let bfd_perform_relocation finish everything up.  */
   return bfd_reloc_continue;