Blame SOURCES/binutils-CVE-2018-7570.patch

869a11
--- binutils.orig/bfd/elf.c	2018-05-01 11:42:03.151425659 +0100
869a11
+++ binutils-2.30/bfd/elf.c	2018-05-01 12:30:42.129206856 +0100
869a11
@@ -5713,6 +5713,9 @@ assign_file_positions_for_load_sections
869a11
   return TRUE;
869a11
 }
869a11
 
869a11
+#define IS_TBSS(s) \
869a11
+  ((s->flags & (SEC_THREAD_LOCAL | SEC_LOAD)) == SEC_THREAD_LOCAL)
869a11
+
869a11
 /* Assign file positions for the other sections.  */
869a11
 
869a11
 static bfd_boolean
869a11
@@ -5862,65 +5865,100 @@ assign_file_positions_for_non_load_secti
869a11
     {
869a11
       if (p->p_type == PT_GNU_RELRO)
869a11
 	{
869a11
-	  const Elf_Internal_Phdr *lp;
869a11
-	  struct elf_segment_map *lm;
869a11
+	  bfd_vma start, end;
869a11
+	  bfd_boolean ok;
869a11
 
869a11
 	  if (link_info != NULL)
869a11
 	    {
869a11
 	      /* During linking the range of the RELRO segment is passed
869a11
-		 in link_info.  */
869a11
+		 in link_info.  Note that there may be padding between
869a11
+		 relro_start and the first RELRO section.  */
869a11
+	      start = link_info->relro_start;
869a11
+	      end = link_info->relro_end;
869a11
+	    }
869a11
+	  else if (m->count != 0)
869a11
+	    {
869a11
+	      if (!m->p_size_valid)
869a11
+		abort ();
869a11
+	      start = m->sections[0]->vma;
869a11
+	      end = start + m->p_size;
869a11
+	    }
869a11
+	  else
869a11
+	    {
869a11
+	      start = 0;
869a11
+	      end = 0;
869a11
+	    }
869a11
+
869a11
+	  ok = FALSE;
869a11
+	  if (start < end)
869a11
+	    {
869a11
+	      struct elf_segment_map *lm;
869a11
+	      const Elf_Internal_Phdr *lp;
869a11
+	      unsigned int i;
869a11
+
869a11
+	      /* Find a LOAD segment containing a section in the RELRO
869a11
+		 segment.  */
869a11
 	      for (lm = elf_seg_map (abfd), lp = phdrs;
869a11
 		   lm != NULL;
869a11
 		   lm = lm->next, lp++)
869a11
 		{
869a11
 		  if (lp->p_type == PT_LOAD
869a11
-		      && lp->p_vaddr < link_info->relro_end
869a11
 		      && lm->count != 0
869a11
-		      && lm->sections[0]->vma >= link_info->relro_start)
869a11
+		      && (lm->sections[lm->count - 1]->vma
869a11
+			  + (!IS_TBSS (lm->sections[lm->count - 1])
869a11
+			     ? lm->sections[lm->count - 1]->size
869a11
+			     : 0)) > start
869a11
+		      && lm->sections[0]->vma < end)
869a11
 		    break;
869a11
 		}
869a11
 
869a11
-	      BFD_ASSERT (lm != NULL);
869a11
-	    }
869a11
-	  else
869a11
-	    {
869a11
-	      /* Otherwise we are copying an executable or shared
869a11
-		 library, but we need to use the same linker logic.  */
869a11
-	      for (lp = phdrs; lp < phdrs + count; ++lp)
869a11
+	      if (lm != NULL)
869a11
 		{
869a11
-		  if (lp->p_type == PT_LOAD
869a11
-		      && lp->p_paddr == p->p_paddr)
869a11
-		    break;
869a11
+		  /* Find the section starting the RELRO segment.  */
869a11
+		  for (i = 0; i < lm->count; i++)
869a11
+		    {
869a11
+		      asection *s = lm->sections[i];
869a11
+		      if (s->vma >= start
869a11
+			  && s->vma < end
869a11
+			  && s->size != 0)
869a11
+			break;
869a11
+		    }
869a11
+
869a11
+		  if (i < lm->count)
869a11
+		    {
869a11
+		      p->p_vaddr = lm->sections[i]->vma;
869a11
+		      p->p_paddr = lm->sections[i]->lma;
869a11
+		      p->p_offset = lm->sections[i]->filepos;
869a11
+		      p->p_memsz = end - p->p_vaddr;
869a11
+		      p->p_filesz = p->p_memsz;
869a11
+
869a11
+		      /* The RELRO segment typically ends a few bytes
869a11
+			 into .got.plt but other layouts are possible.
869a11
+			 In cases where the end does not match any
869a11
+			 loaded section (for instance is in file
869a11
+			 padding), trim p_filesz back to correspond to
869a11
+			 the end of loaded section contents.  */
869a11
+		      if (p->p_filesz > lp->p_vaddr + lp->p_filesz - p->p_vaddr)
869a11
+			p->p_filesz = lp->p_vaddr + lp->p_filesz - p->p_vaddr;
869a11
+
869a11
+		      /* Preserve the alignment and flags if they are
869a11
+			 valid.  The gold linker generates RW/4 for
869a11
+			 the PT_GNU_RELRO section.  It is better for
869a11
+			 objcopy/strip to honor these attributes
869a11
+			 otherwise gdb will choke when using separate
869a11
+			 debug files.  */
869a11
+		      if (!m->p_align_valid)
869a11
+			p->p_align = 1;
869a11
+		      if (!m->p_flags_valid)
869a11
+			p->p_flags = PF_R;
869a11
+		      ok = TRUE;
869a11
+		    }
869a11
 		}
869a11
 	    }
869a11
-
869a11
-	  if (lp < phdrs + count)
869a11
-	    {
869a11
-	      p->p_vaddr = lp->p_vaddr;
869a11
-	      p->p_paddr = lp->p_paddr;
869a11
-	      p->p_offset = lp->p_offset;
869a11
-	      if (link_info != NULL)
869a11
-		p->p_filesz = link_info->relro_end - lp->p_vaddr;
869a11
-	      else if (m->p_size_valid)
869a11
-		p->p_filesz = m->p_size;
869a11
-	      else
869a11
-		abort ();
869a11
-	      p->p_memsz = p->p_filesz;
869a11
-	      /* Preserve the alignment and flags if they are valid. The
869a11
-		 gold linker generates RW/4 for the PT_GNU_RELRO section.
869a11
-		 It is better for objcopy/strip to honor these attributes
869a11
-		 otherwise gdb will choke when using separate debug files.
869a11
-	       */
869a11
-	      if (!m->p_align_valid)
869a11
-		p->p_align = 1;
869a11
-	      if (!m->p_flags_valid)
869a11
-		p->p_flags = PF_R;
869a11
-	    }
869a11
-	  else
869a11
-	    {
869a11
-	      memset (p, 0, sizeof *p);
869a11
-	      p->p_type = PT_NULL;
869a11
-	    }
869a11
+	  if (link_info != NULL)
869a11
+	    BFD_ASSERT (ok);
869a11
+	  if (!ok)
869a11
+	    memset (p, 0, sizeof *p);
869a11
 	}
869a11
       else if (p->p_type == PT_GNU_STACK)
869a11
 	{