commit e2996cc315d6ea242e1a954dc20246485ccc8512
Author: Nick Clifton <nickc@redhat.com>
Date:   Mon Dec 5 14:32:30 2016 +0000

    Fix seg-fault running strip on a corrupt binary.
    
        PR binutils/20921
        * aoutx.h (squirt_out_relocs): Check for and report any relocs
        that could not be recognised.

Upstream-Status: Backport

CVE: CVE-2017-7302
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>

Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog	2017-09-04 15:57:38.564419146 +0530
+++ git/bfd/ChangeLog	2017-09-04 16:02:31.994883900 +0530
@@ -124,6 +124,10 @@
        (aout_link_add_symbols): Fix off by one error checking for
        overflow of string offset.
 
+       PR binutils/20921
+       * aoutx.h (squirt_out_relocs): Check for and report any relocs
+       that could not be recognised.
+
 2016-12-01  Nick Clifton  <nickc@redhat.com>
 
        PR binutils/20891
Index: git/bfd/aoutx.h
===================================================================
--- git.orig/bfd/aoutx.h	2017-09-04 15:57:38.564419146 +0530
+++ git/bfd/aoutx.h	2017-09-04 16:01:08.830188291 +0530
@@ -1952,6 +1952,7 @@
 
   PUT_WORD (abfd, g->address, natptr->r_address);
 
+  BFD_ASSERT (g->howto != NULL);
   r_length = g->howto->size ;	/* Size as a power of two.  */
   r_pcrel  = (int) g->howto->pc_relative; /* Relative to PC?  */
   /* XXX This relies on relocs coming from a.out files.  */
@@ -2390,16 +2391,34 @@
       for (natptr = native;
 	   count != 0;
 	   --count, natptr += each_size, ++generic)
-	MY_swap_ext_reloc_out (abfd, *generic,
-			       (struct reloc_ext_external *) natptr);
+	{
+	  if ((*generic)->howto == NULL)
+	    {
+	      bfd_set_error (bfd_error_invalid_operation);
+	      _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd);
+	      return FALSE;
+	    }
+	  MY_swap_ext_reloc_out (abfd, *generic,
+				 (struct reloc_ext_external *) natptr);
+	}
     }
   else
     {
       for (natptr = native;
 	   count != 0;
 	   --count, natptr += each_size, ++generic)
-	MY_swap_std_reloc_out (abfd, *generic,
-			       (struct reloc_std_external *) natptr);
+	{
+	  /* PR 20921: If the howto field has not been initialised then skip
+	     this reloc.  */
+	  if ((*generic)->howto == NULL)
+	    {
+	      bfd_set_error (bfd_error_invalid_operation);
+	      _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd);
+	      return FALSE;
+	    }
+	  MY_swap_std_reloc_out (abfd, *generic,
+				 (struct reloc_std_external *) natptr);
+	}
     }
 
   if (bfd_bwrite ((void *) native, natsize, abfd) != natsize)