PR25569, PDP11 ld -s clobbers last data byte

This patch fixes an ancient wart in aout support, in that text and
data section sizes are rounded up for alignment rather that just the
corresponding header sizes.  Changing section sizes could conceivably
result in buffer overflows if section contents were held in memory.
Also, keeping the original section sizes allows this PR to be fixed
nicely.

bfd/
	PR 25569
	* aoutx.h (adjust_o_magic, adjust_z_magic, adjust_n_magic): Use
	"text", "data" and "bss" section pointer vars.  Don't update
	section size, just exec header sizes.
	(adjust_sizes_and_vmas): Don't update text section size.  Set
	initial exec header a_text.  Print exec headers sizes.
	* pdp11.c (adjust_o_magic, adjust_z_magic, adjust_n_magic),
	(adjust_sizes_and_vmas): Similarly.  Formatting.
	(final_link): Correct final file extension.
gas/
	PR 25569
	* config/obj-aout.c (obj_aout_frob_file_before_fix): Don't loop
	on section size adjustment, instead perform another write if
	exec header size is larger than section size.

5 files changed, 264 insertions, 242 deletions

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 6ee734c4fc9..0f9c3e51f32 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,15 @@
+2020-02-21  Alan Modra  <amodra@gmail.com>
+
+	PR 25569
+	* aoutx.h (adjust_o_magic, adjust_z_magic, adjust_n_magic): Use
+	"text", "data" and "bss" section pointer vars.  Don't update
+	section size, just exec header sizes.
+	(adjust_sizes_and_vmas): Don't update text section size.  Set
+	initial exec header a_text.  Print exec headers sizes.
+	* pdp11.c (adjust_o_magic, adjust_z_magic, adjust_n_magic),
+	(adjust_sizes_and_vmas): Similarly.  Formatting.
+	(final_link): Correct final file extension.
+
 2020-02-20  Nick Clifton  <nickc@redhat.com>
 
 	* elf-bfd.h (struct elf_backend_data): Add symbol_section_index
diff --git a/bfd/aoutx.h b/bfd/aoutx.h
index b843357b091..fef75e54525 100644
--- a/bfd/aoutx.h
+++ b/bfd/aoutx.h
@@ -891,57 +891,56 @@ adjust_o_magic (bfd *abfd, struct internal_exec *execp)
   file_ptr pos = adata (abfd).exec_bytes_size;
   bfd_vma vma = 0;
   int pad = 0;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   /* Text.  */
-  obj_textsec (abfd)->filepos = pos;
-  if (!obj_textsec (abfd)->user_set_vma)
-    obj_textsec (abfd)->vma = vma;
+  text->filepos = pos;
+  if (!text->user_set_vma)
+    text->vma = vma;
   else
-    vma = obj_textsec (abfd)->vma;
+    vma = text->vma;
 
-  pos += obj_textsec (abfd)->size;
-  vma += obj_textsec (abfd)->size;
+  pos += execp->a_text;
+  vma += execp->a_text;
 
   /* Data.  */
-  if (!obj_datasec (abfd)->user_set_vma)
+  if (!data->user_set_vma)
     {
-      obj_textsec (abfd)->size += pad;
       pos += pad;
       vma += pad;
-      obj_datasec (abfd)->vma = vma;
+      data->vma = vma;
     }
   else
-    vma = obj_datasec (abfd)->vma;
-  obj_datasec (abfd)->filepos = pos;
-  pos += obj_datasec (abfd)->size;
-  vma += obj_datasec (abfd)->size;
+    vma = data->vma;
+  execp->a_text += pad;
+
+  data->filepos = pos;
+  pos += data->size;
+  vma += data->size;
 
   /* BSS.  */
-  if (!obj_bsssec (abfd)->user_set_vma)
+  if (!bss->user_set_vma)
     {
-      obj_datasec (abfd)->size += pad;
       pos += pad;
       vma += pad;
-      obj_bsssec (abfd)->vma = vma;
+      bss->vma = vma;
     }
   else
     {
       /* The VMA of the .bss section is set by the VMA of the
 	 .data section plus the size of the .data section.  We may
 	 need to add padding bytes to make this true.  */
-      pad = obj_bsssec (abfd)->vma - vma;
-      if (pad > 0)
-	{
-	  obj_datasec (abfd)->size += pad;
-	  pos += pad;
-	}
+      pad = bss->vma - vma;
+      if (pad < 0)
+	pad = 0;
+      pos += pad;
     }
-  obj_bsssec (abfd)->filepos = pos;
+  execp->a_data = data->size + pad;
+  bss->filepos = pos;
+  execp->a_bss = bss->size;
 
-  /* Fix up the exec header.  */
-  execp->a_text = obj_textsec (abfd)->size;
-  execp->a_data = obj_datasec (abfd)->size;
-  execp->a_bss = obj_bsssec (abfd)->size;
   N_SET_MAGIC (execp, OMAGIC);
 }
 
@@ -953,6 +952,9 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
   const struct aout_backend_data *abdp;
   /* TRUE if text includes exec header.  */
   bfd_boolean ztih;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   abdp = aout_backend_info (abfd);
 
@@ -960,18 +962,17 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
   ztih = (abdp != NULL
 	  && (abdp->text_includes_header
 	      || obj_aout_subformat (abfd) == q_magic_format));
-  obj_textsec (abfd)->filepos = (ztih
-				 ? adata (abfd).exec_bytes_size
-				 : adata (abfd).zmagic_disk_block_size);
-  if (! obj_textsec (abfd)->user_set_vma)
+  text->filepos = (ztih
+		   ? adata (abfd).exec_bytes_size
+		   : adata (abfd).zmagic_disk_block_size);
+  if (!text->user_set_vma)
     {
       /* ?? Do we really need to check for relocs here?  */
-      obj_textsec (abfd)->vma = ((abfd->flags & HAS_RELOC)
-				 ? 0
-				 : (ztih
-				    ? (abdp->default_text_vma
-				       + adata (abfd).exec_bytes_size)
-				    : abdp->default_text_vma));
+      text->vma = ((abfd->flags & HAS_RELOC)
+		   ? 0
+		   : (ztih
+		      ? abdp->default_text_vma + adata (abfd).exec_bytes_size
+		      : abdp->default_text_vma));
       text_pad = 0;
     }
   else
@@ -980,17 +981,17 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
 	 may need to pad it such that the .data section starts at a page
 	 boundary.  */
       if (ztih)
-	text_pad = ((obj_textsec (abfd)->filepos - obj_textsec (abfd)->vma)
+	text_pad = ((text->filepos - text->vma)
 		    & (adata (abfd).page_size - 1));
       else
-	text_pad = ((- obj_textsec (abfd)->vma)
+	text_pad = (-text->vma
 		    & (adata (abfd).page_size - 1));
     }
 
   /* Find start of data.  */
   if (ztih)
     {
-      text_end = obj_textsec (abfd)->filepos + obj_textsec (abfd)->size;
+      text_end = text->filepos + execp->a_text;
       text_pad += BFD_ALIGN (text_end, adata (abfd).page_size) - text_end;
     }
   else
@@ -998,36 +999,30 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
       /* Note that if page_size == zmagic_disk_block_size, then
 	 filepos == page_size, and this case is the same as the ztih
 	 case.  */
-      text_end = obj_textsec (abfd)->size;
+      text_end = execp->a_text;
       text_pad += BFD_ALIGN (text_end, adata (abfd).page_size) - text_end;
-      text_end += obj_textsec (abfd)->filepos;
+      text_end += text->filepos;
     }
-  obj_textsec (abfd)->size += text_pad;
-  text_end += text_pad;
+  execp->a_text += text_pad;
 
   /* Data.  */
-  if (!obj_datasec (abfd)->user_set_vma)
+  if (!data->user_set_vma)
     {
       bfd_vma vma;
-      vma = obj_textsec (abfd)->vma + obj_textsec (abfd)->size;
-      obj_datasec (abfd)->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
+      vma = text->vma + execp->a_text;
+      data->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
     }
   if (abdp && abdp->zmagic_mapped_contiguous)
     {
-      asection * text = obj_textsec (abfd);
-      asection * data = obj_datasec (abfd);
-
-      text_pad = data->vma - (text->vma + text->size);
+      text_pad = data->vma - (text->vma + execp->a_text);
       /* Only pad the text section if the data
 	 section is going to be placed after it.  */
       if (text_pad > 0)
-	text->size += text_pad;
+	execp->a_text += text_pad;
     }
-  obj_datasec (abfd)->filepos = (obj_textsec (abfd)->filepos
-				 + obj_textsec (abfd)->size);
+  data->filepos = text->filepos + execp->a_text;
 
   /* Fix up exec header while we're at it.  */
-  execp->a_text = obj_textsec (abfd)->size;
   if (ztih && (!abdp || (abdp && !abdp->exec_header_not_counted)))
     execp->a_text += adata (abfd).exec_bytes_size;
   if (obj_aout_subformat (abfd) == q_magic_format)
@@ -1036,17 +1031,13 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
     N_SET_MAGIC (execp, ZMAGIC);
 
   /* Spec says data section should be rounded up to page boundary.  */
-  obj_datasec (abfd)->size
-    = align_power (obj_datasec (abfd)->size,
-		   obj_bsssec (abfd)->alignment_power);
-  execp->a_data = BFD_ALIGN (obj_datasec (abfd)->size,
-			     adata (abfd).page_size);
-  data_pad = execp->a_data - obj_datasec (abfd)->size;
+  execp->a_data = align_power (data->size, bss->alignment_power);
+  execp->a_data = BFD_ALIGN (execp->a_data, adata (abfd).page_size);
+  data_pad = execp->a_data - data->size;
 
   /* BSS.  */
-  if (!obj_bsssec (abfd)->user_set_vma)
-    obj_bsssec (abfd)->vma = (obj_datasec (abfd)->vma
-			      + obj_datasec (abfd)->size);
+  if (!bss->user_set_vma)
+    bss->vma = data->vma + execp->a_data;
   /* If the BSS immediately follows the data section and extra space
      in the page is left after the data section, fudge data
      in the header so that the bss section looks smaller by that
@@ -1054,12 +1045,10 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
      (Note that a linker script, as well as the above assignment,
      could have explicitly set the BSS vma to immediately follow
      the data section.)  */
-  if (align_power (obj_bsssec (abfd)->vma, obj_bsssec (abfd)->alignment_power)
-      == obj_datasec (abfd)->vma + obj_datasec (abfd)->size)
-    execp->a_bss = (data_pad > obj_bsssec (abfd)->size
-		    ? 0 : obj_bsssec (abfd)->size - data_pad);
+  if (align_power (bss->vma, bss->alignment_power) == data->vma + execp->a_data)
+    execp->a_bss = data_pad > bss->size ? 0 : bss->size - data_pad;
   else
-    execp->a_bss = obj_bsssec (abfd)->size;
+    execp->a_bss = bss->size;
 }
 
 static void
@@ -1068,38 +1057,39 @@ adjust_n_magic (bfd *abfd, struct internal_exec *execp)
   file_ptr pos = adata (abfd).exec_bytes_size;
   bfd_vma vma = 0;
   int pad;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   /* Text.  */
-  obj_textsec (abfd)->filepos = pos;
-  if (!obj_textsec (abfd)->user_set_vma)
-    obj_textsec (abfd)->vma = vma;
+  text->filepos = pos;
+  if (!text->user_set_vma)
+    text->vma = vma;
   else
-    vma = obj_textsec (abfd)->vma;
-  pos += obj_textsec (abfd)->size;
-  vma += obj_textsec (abfd)->size;
+    vma = text->vma;
+  pos += execp->a_text;
+  vma += execp->a_text;
 
   /* Data.  */
-  obj_datasec (abfd)->filepos = pos;
-  if (!obj_datasec (abfd)->user_set_vma)
-    obj_datasec (abfd)->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
-  vma = obj_datasec (abfd)->vma;
+  data->filepos = pos;
+  if (!data->user_set_vma)
+    data->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
+  vma = data->vma;
 
   /* Since BSS follows data immediately, see if it needs alignment.  */
-  vma += obj_datasec (abfd)->size;
-  pad = align_power (vma, obj_bsssec (abfd)->alignment_power) - vma;
-  obj_datasec (abfd)->size += pad;
-  pos += obj_datasec (abfd)->size;
+  vma += data->size;
+  pad = align_power (vma, bss->alignment_power) - vma;
+  execp->a_data = data->size + pad;
+  pos += execp->a_data;
 
   /* BSS.  */
-  if (!obj_bsssec (abfd)->user_set_vma)
-    obj_bsssec (abfd)->vma = vma;
+  if (!bss->user_set_vma)
+    bss->vma = vma;
   else
-    vma = obj_bsssec (abfd)->vma;
+    vma = bss->vma;
 
   /* Fix up exec header.  */
-  execp->a_text = obj_textsec (abfd)->size;
-  execp->a_data = obj_datasec (abfd)->size;
-  execp->a_bss = obj_bsssec (abfd)->size;
+  execp->a_bss = bss->size;
   N_SET_MAGIC (execp, NMAGIC);
 }
 
@@ -1114,9 +1104,8 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
   if (adata (abfd).magic != undecided_magic)
     return TRUE;
 
-  obj_textsec (abfd)->size =
-    align_power (obj_textsec (abfd)->size,
-		 obj_textsec (abfd)->alignment_power);
+  execp->a_text = align_power (obj_textsec (abfd)->size,
+			       obj_textsec (abfd)->alignment_power);
 
   /* Rule (heuristic) for when to pad to a new page.  Note that there
      are (at least) two ways demand-paged (ZMAGIC) files have been
@@ -1181,11 +1170,11 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
 
 #ifdef BFD_AOUT_DEBUG
   fprintf (stderr, "       text=<%x,%x,%x> data=<%x,%x,%x> bss=<%x,%x>\n",
-	   obj_textsec (abfd)->vma, obj_textsec (abfd)->size,
+	   obj_textsec (abfd)->vma, execp->a_text,
 		obj_textsec (abfd)->filepos,
-	   obj_datasec (abfd)->vma, obj_datasec (abfd)->size,
+	   obj_datasec (abfd)->vma, execp->a_data,
 		obj_datasec (abfd)->filepos,
-	   obj_bsssec (abfd)->vma, obj_bsssec (abfd)->size);
+	   obj_bsssec (abfd)->vma, execp->a_bss);
 #endif
 
   return TRUE;
diff --git a/bfd/pdp11.c b/bfd/pdp11.c
index 35aefa34047..50d006f0859 100644
--- a/bfd/pdp11.c
+++ b/bfd/pdp11.c
@@ -789,57 +789,56 @@ adjust_o_magic (bfd *abfd, struct internal_exec *execp)
   file_ptr pos = adata (abfd).exec_bytes_size;
   bfd_vma vma = 0;
   int pad = 0;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   /* Text.  */
-  obj_textsec (abfd)->filepos = pos;
-  if (! obj_textsec (abfd)->user_set_vma)
-    obj_textsec (abfd)->vma = vma;
+  text->filepos = pos;
+  if (!text->user_set_vma)
+    text->vma = vma;
   else
-    vma = obj_textsec (abfd)->vma;
+    vma = text->vma;
 
-  pos += obj_textsec (abfd)->size;
-  vma += obj_textsec (abfd)->size;
+  pos += execp->a_text;
+  vma += execp->a_text;
 
   /* Data.  */
-  if (!obj_datasec (abfd)->user_set_vma)
+  if (!data->user_set_vma)
     {
-      obj_textsec (abfd)->size += pad;
       pos += pad;
       vma += pad;
-      obj_datasec (abfd)->vma = vma;
+      data->vma = vma;
     }
   else
-    vma = obj_datasec (abfd)->vma;
-  obj_datasec (abfd)->filepos = pos;
-  pos += obj_datasec (abfd)->size;
-  vma += obj_datasec (abfd)->size;
+    vma = data->vma;
+  execp->a_text += pad;
+
+  data->filepos = pos;
+  pos += data->size;
+  vma += data->size;
 
   /* BSS.  */
-  if (! obj_bsssec (abfd)->user_set_vma)
+  if (!bss->user_set_vma)
     {
-      obj_datasec (abfd)->size += pad;
       pos += pad;
       vma += pad;
-      obj_bsssec (abfd)->vma = vma;
+      bss->vma = vma;
     }
   else
     {
       /* The VMA of the .bss section is set by the VMA of the
 	 .data section plus the size of the .data section.  We may
 	 need to add padding bytes to make this true.  */
-      pad = obj_bsssec (abfd)->vma - vma;
-      if (pad > 0)
-	{
-	  obj_datasec (abfd)->size += pad;
-	  pos += pad;
-	}
+      pad = bss->vma - vma;
+      if (pad < 0)
+	pad = 0;
+      pos += pad;
     }
-  obj_bsssec (abfd)->filepos = pos;
+  execp->a_data = data->size + pad;
+  bss->filepos = pos;
+  execp->a_bss = bss->size;
 
-  /* Fix up the exec header.  */
-  execp->a_text = obj_textsec (abfd)->size;
-  execp->a_data = obj_datasec (abfd)->size;
-  execp->a_bss  = obj_bsssec (abfd)->size;
   N_SET_MAGIC (execp, OMAGIC);
 }
 
@@ -849,7 +848,11 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
   bfd_size_type data_pad, text_pad;
   file_ptr text_end;
   const struct aout_backend_data *abdp;
-  int ztih;			/* Nonzero if text includes exec header.  */
+  /* TRUE if text includes exec header.  */
+  bfd_boolean ztih;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   abdp = aout_backend_info (abfd);
 
@@ -857,18 +860,17 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
   ztih = (abdp != NULL
 	  && (abdp->text_includes_header
 	      || obj_aout_subformat (abfd) == q_magic_format));
-  obj_textsec(abfd)->filepos = (ztih
-				? adata(abfd).exec_bytes_size
-				: adata(abfd).zmagic_disk_block_size);
-  if (! obj_textsec(abfd)->user_set_vma)
+  text->filepos = (ztih
+		   ? adata (abfd).exec_bytes_size
+		   : adata (abfd).zmagic_disk_block_size);
+  if (!text->user_set_vma)
     {
       /* ?? Do we really need to check for relocs here?  */
-      obj_textsec(abfd)->vma = ((abfd->flags & HAS_RELOC)
-				? 0
-				: (ztih
-				   ? (abdp->default_text_vma
-				      + adata (abfd).exec_bytes_size)
-				   : abdp->default_text_vma));
+      text->vma = ((abfd->flags & HAS_RELOC)
+		   ? 0
+		   : (ztih
+		      ? abdp->default_text_vma + adata (abfd).exec_bytes_size
+		      : abdp->default_text_vma));
       text_pad = 0;
     }
   else
@@ -877,17 +879,17 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
 	 may need to pad it such that the .data section starts at a page
 	 boundary.  */
       if (ztih)
-	text_pad = ((obj_textsec (abfd)->filepos - obj_textsec (abfd)->vma)
+	text_pad = ((text->filepos - text->vma)
 		    & (adata (abfd).page_size - 1));
       else
-	text_pad = ((- obj_textsec (abfd)->vma)
+	text_pad = (-text->vma
 		    & (adata (abfd).page_size - 1));
     }
 
   /* Find start of data.  */
   if (ztih)
     {
-      text_end = obj_textsec (abfd)->filepos + obj_textsec (abfd)->size;
+      text_end = text->filepos + execp->a_text;
       text_pad += BFD_ALIGN (text_end, adata (abfd).page_size) - text_end;
     }
   else
@@ -895,49 +897,42 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
       /* Note that if page_size == zmagic_disk_block_size, then
 	 filepos == page_size, and this case is the same as the ztih
 	 case.  */
-      text_end = obj_textsec (abfd)->size;
+      text_end = execp->a_text;
       text_pad += BFD_ALIGN (text_end, adata (abfd).page_size) - text_end;
-      text_end += obj_textsec (abfd)->filepos;
+      text_end += text->filepos;
     }
-
-  obj_textsec (abfd)->size += text_pad;
-  text_end += text_pad;
+  execp->a_text += text_pad;
 
   /* Data.  */
-  if (!obj_datasec(abfd)->user_set_vma)
+  if (!data->user_set_vma)
     {
       bfd_vma vma;
-      vma = obj_textsec(abfd)->vma + obj_textsec(abfd)->size;
-      obj_datasec(abfd)->vma = BFD_ALIGN (vma, adata(abfd).segment_size);
+      vma = text->vma + execp->a_text;
+      data->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
     }
   if (abdp && abdp->zmagic_mapped_contiguous)
     {
-      text_pad = (obj_datasec(abfd)->vma
-		  - obj_textsec(abfd)->vma
-		  - obj_textsec(abfd)->size);
-      obj_textsec(abfd)->size += text_pad;
+      text_pad = data->vma - (text->vma + execp->a_text);
+      /* Only pad the text section if the data
+	 section is going to be placed after it.  */
+      if (text_pad > 0)
+	execp->a_text += text_pad;
     }
-  obj_datasec (abfd)->filepos = (obj_textsec (abfd)->filepos
-				+ obj_textsec (abfd)->size);
+  data->filepos = text->filepos + execp->a_text;
 
   /* Fix up exec header while we're at it.  */
-  execp->a_text = obj_textsec(abfd)->size;
   if (ztih && (!abdp || (abdp && !abdp->exec_header_not_counted)))
-    execp->a_text += adata(abfd).exec_bytes_size;
+    execp->a_text += adata (abfd).exec_bytes_size;
   N_SET_MAGIC (execp, ZMAGIC);
 
   /* Spec says data section should be rounded up to page boundary.  */
-  obj_datasec(abfd)->size
-    = align_power (obj_datasec(abfd)->size,
-		   obj_bsssec(abfd)->alignment_power);
-  execp->a_data = BFD_ALIGN (obj_datasec(abfd)->size,
-			     adata(abfd).page_size);
-  data_pad = execp->a_data - obj_datasec(abfd)->size;
+  execp->a_data = align_power (data->size, bss->alignment_power);
+  execp->a_data = BFD_ALIGN (execp->a_data, adata (abfd).page_size);
+  data_pad = execp->a_data - data->size;
 
   /* BSS.  */
-  if (!obj_bsssec(abfd)->user_set_vma)
-    obj_bsssec(abfd)->vma = (obj_datasec(abfd)->vma
-			     + obj_datasec(abfd)->size);
+  if (!bss->user_set_vma)
+    bss->vma = data->vma + execp->a_data;
   /* If the BSS immediately follows the data section and extra space
      in the page is left after the data section, fudge data
      in the header so that the bss section looks smaller by that
@@ -945,52 +940,51 @@ adjust_z_magic (bfd *abfd, struct internal_exec *execp)
      (Note that a linker script, as well as the above assignment,
      could have explicitly set the BSS vma to immediately follow
      the data section.)  */
-  if (align_power (obj_bsssec(abfd)->vma, obj_bsssec(abfd)->alignment_power)
-      == obj_datasec(abfd)->vma + obj_datasec(abfd)->size)
-    execp->a_bss = (data_pad > obj_bsssec(abfd)->size) ? 0 :
-      obj_bsssec(abfd)->size - data_pad;
+  if (align_power (bss->vma, bss->alignment_power) == data->vma + execp->a_data)
+    execp->a_bss = data_pad > bss->size ? 0 : bss->size - data_pad;
   else
-    execp->a_bss = obj_bsssec(abfd)->size;
+    execp->a_bss = bss->size;
 }
 
 static void
 adjust_n_magic (bfd *abfd, struct internal_exec *execp)
 {
-  file_ptr pos = adata(abfd).exec_bytes_size;
+  file_ptr pos = adata (abfd).exec_bytes_size;
   bfd_vma vma = 0;
   int pad;
+  asection *text = obj_textsec (abfd);
+  asection *data = obj_datasec (abfd);
+  asection *bss = obj_bsssec (abfd);
 
   /* Text.  */
-  obj_textsec(abfd)->filepos = pos;
-  if (!obj_textsec(abfd)->user_set_vma)
-    obj_textsec(abfd)->vma = vma;
+  text->filepos = pos;
+  if (!text->user_set_vma)
+    text->vma = vma;
   else
-    vma = obj_textsec(abfd)->vma;
-  pos += obj_textsec(abfd)->size;
-  vma += obj_textsec(abfd)->size;
+    vma = text->vma;
+  pos += execp->a_text;
+  vma += execp->a_text;
 
   /* Data.  */
-  obj_datasec(abfd)->filepos = pos;
-  if (!obj_datasec(abfd)->user_set_vma)
-    obj_datasec(abfd)->vma = BFD_ALIGN (vma, adata(abfd).segment_size);
-  vma = obj_datasec(abfd)->vma;
+  data->filepos = pos;
+  if (!data->user_set_vma)
+    data->vma = BFD_ALIGN (vma, adata (abfd).segment_size);
+  vma = data->vma;
 
   /* Since BSS follows data immediately, see if it needs alignment.  */
-  vma += obj_datasec(abfd)->size;
-  pad = align_power (vma, obj_bsssec(abfd)->alignment_power) - vma;
-  obj_datasec(abfd)->size += pad;
-  pos += obj_datasec(abfd)->size;
+  vma += data->size;
+  pad = align_power (vma, bss->alignment_power) - vma;
+  execp->a_data = data->size + pad;
+  pos += execp->a_data;
 
   /* BSS.  */
-  if (!obj_bsssec(abfd)->user_set_vma)
-    obj_bsssec(abfd)->vma = vma;
+  if (!bss->user_set_vma)
+    bss->vma = vma;
   else
-    vma = obj_bsssec(abfd)->vma;
+    vma = bss->vma;
 
   /* Fix up exec header.  */
-  execp->a_text = obj_textsec(abfd)->size;
-  execp->a_data = obj_datasec(abfd)->size;
-  execp->a_bss = obj_bsssec(abfd)->size;
+  execp->a_bss = bss->size;
   N_SET_MAGIC (execp, NMAGIC);
 }
 
@@ -1002,12 +996,11 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
   if (! NAME (aout, make_sections) (abfd))
     return FALSE;
 
-  if (adata(abfd).magic != undecided_magic)
+  if (adata (abfd).magic != undecided_magic)
     return TRUE;
 
-  obj_textsec(abfd)->size =
-    align_power(obj_textsec(abfd)->size,
-		obj_textsec(abfd)->alignment_power);
+  execp->a_text = align_power (obj_textsec (abfd)->size,
+			       obj_textsec (abfd)->alignment_power);
 
   /* Rule (heuristic) for when to pad to a new page.  Note that there
      are (at least) two ways demand-paged (ZMAGIC) files have been
@@ -1015,7 +1008,7 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
      (TARGET_PAGE_SIZE).  However, newer versions of SUNOS start the text
      segment right after the exec header; the latter is counted in the
      text segment size, and is paged in by the kernel with the rest of
-     the text. */
+     the text.  */
 
   /* This perhaps isn't the right way to do this, but made it simpler for me
      to understand enough to implement it.  Better would probably be to go
@@ -1026,32 +1019,33 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
      minute.  */
 
   if (abfd->flags & WP_TEXT)
-    adata(abfd).magic = n_magic;
+    adata (abfd).magic = n_magic;
   else
-    adata(abfd).magic = o_magic;
+    adata (abfd).magic = o_magic;
 
 #ifdef BFD_AOUT_DEBUG /* requires gcc2 */
 #if __GNUC__ >= 2
   fprintf (stderr, "%s text=<%x,%x,%x> data=<%x,%x,%x> bss=<%x,%x,%x>\n",
 	   ({ char *str;
-	      switch (adata(abfd).magic) {
-	      case n_magic: str = "NMAGIC"; break;
-	      case o_magic: str = "OMAGIC"; break;
-	      case z_magic: str = "ZMAGIC"; break;
-	      default: abort ();
-	      }
+	      switch (adata (abfd).magic)
+		{
+		case n_magic: str = "NMAGIC"; break;
+		case o_magic: str = "OMAGIC"; break;
+		case z_magic: str = "ZMAGIC"; break;
+		default: abort ();
+		}
 	      str;
 	    }),
-	   obj_textsec(abfd)->vma, obj_textsec(abfd)->size,
-		obj_textsec(abfd)->alignment_power,
-	   obj_datasec(abfd)->vma, obj_datasec(abfd)->size,
-		obj_datasec(abfd)->alignment_power,
-	   obj_bsssec(abfd)->vma, obj_bsssec(abfd)->size,
-		obj_bsssec(abfd)->alignment_power);
+	   obj_textsec (abfd)->vma, obj_textsec (abfd)->size,
+		obj_textsec (abfd)->alignment_power,
+	   obj_datasec (abfd)->vma, obj_datasec (abfd)->size,
+		obj_datasec (abfd)->alignment_power,
+	   obj_bsssec (abfd)->vma, obj_bsssec (abfd)->size,
+		obj_bsssec (abfd)->alignment_power);
 #endif
 #endif
 
-  switch (adata(abfd).magic)
+  switch (adata (abfd).magic)
     {
     case o_magic:
       adjust_o_magic (abfd, execp);
@@ -1068,11 +1062,11 @@ NAME (aout, adjust_sizes_and_vmas) (bfd *abfd)
 
 #ifdef BFD_AOUT_DEBUG
   fprintf (stderr, "       text=<%x,%x,%x> data=<%x,%x,%x> bss=<%x,%x>\n",
-	   obj_textsec(abfd)->vma, obj_textsec(abfd)->size,
-		obj_textsec(abfd)->filepos,
-	   obj_datasec(abfd)->vma, obj_datasec(abfd)->size,
-		obj_datasec(abfd)->filepos,
-	   obj_bsssec(abfd)->vma, obj_bsssec(abfd)->size);
+	   obj_textsec (abfd)->vma, execp->a_text,
+		obj_textsec (abfd)->filepos,
+	   obj_datasec (abfd)->vma, execp->a_data,
+		obj_datasec (abfd)->filepos,
+	   obj_bsssec (abfd)->vma, execp->a_bss);
 #endif
 
   return TRUE;
@@ -3914,16 +3908,28 @@ NAME (aout, final_link) (bfd *abfd,
   else if (obj_textsec (abfd)->reloc_count == 0
 	   && obj_datasec (abfd)->reloc_count == 0)
     {
-      bfd_byte b;
-
-      b = 0;
-      if (bfd_seek (abfd,
-		    (file_ptr) (obj_datasec (abfd)->filepos
-				+ exec_hdr (abfd)->a_data
-				- 1),
-		    SEEK_SET) != 0
-	  || bfd_bwrite (&b, (bfd_size_type) 1, abfd) != 1)
-	goto error_return;
+      /* The layout of a typical a.out file is header, text, data,
+	 relocs, symbols, string table.  When there are no relocs,
+	 symbols or string table, the last thing in the file is data
+	 and a_data may be rounded up.  However we may have a smaller
+	 sized .data section and thus not written final padding.  The
+	 same thing can happen with text if there is no data.  Write
+	 final padding here to extend the file.  */
+      file_ptr pos = 0;
+
+      if (exec_hdr (abfd)->a_data > obj_datasec (abfd)->size)
+	pos = obj_datasec (abfd)->filepos + exec_hdr (abfd)->a_data;
+      else if (obj_datasec (abfd)->size == 0
+	       && exec_hdr (abfd)->a_text > obj_textsec (abfd)->size)
+	pos = obj_textsec (abfd)->filepos + exec_hdr (abfd)->a_text;
+      if (pos != 0)
+	{
+	  bfd_byte b = 0;
+
+	  if (bfd_seek (abfd, pos - 1, SEEK_SET) != 0
+	      || bfd_bwrite (&b, (bfd_size_type) 1, abfd) != 1)
+	    goto error_return;
+	}
     }
 
   return TRUE;
diff --git a/gas/ChangeLog b/gas/ChangeLog
index fe177cf8e2d..4bc78e9bfc2 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2020-02-21  Alan Modra  <amodra@gmail.com>
+
+	PR 25569
+	* config/obj-aout.c (obj_aout_frob_file_before_fix): Don't loop
+	on section size adjustment, instead perform another write if
+	exec header size is larger than section size.
+
 2020-02-19  Nelson Chu  <nelson.chu@sifive.com>
 
 	* doc/c-riscv.texi: Add the doc entries for -march-attr/
diff --git a/gas/config/obj-aout.c b/gas/config/obj-aout.c
index bdd46a70ec1..aee7c8180a2 100644
--- a/gas/config/obj-aout.c
+++ b/gas/config/obj-aout.c
@@ -113,31 +113,39 @@ obj_aout_frob_symbol (symbolS *sym, int *punt ATTRIBUTE_UNUSED)
 	    S_GET_NAME (sym));
 }
 
+/* Relocation processing may require knowing the VMAs of the sections.
+   Writing to a section will cause the BFD back end to compute the
+   VMAs.  This function also ensures that file size is large enough
+   to cover a_text and a_data should text or data be the last section
+   in the file.  */
+
 void
 obj_aout_frob_file_before_fix (void)
 {
-  /* Relocation processing may require knowing the VMAs of the sections.
-     Since writing to a section will cause the BFD back end to compute the
-     VMAs, fake it out here....
-     Writing to the end of the section ensures the file contents
-     extend to cover the entire aligned size.  We possibly won't know
-     the aligned size until after VMAs and sizes are set on the first
-     bfd_set_section_contents call, so it might be necessary to repeat.  */
-  asection *sec = NULL;
-  if (data_section->size != 0)
-    sec = data_section;
-  else if (text_section->size != 0)
-    sec = text_section;
-  if (sec)
+  asection *sec;
+  bfd_vma *sizep = NULL;
+  if ((sec = data_section)->size != 0)
+    sizep = &exec_hdr (stdoutput)->a_data;
+  else if ((sec = text_section)->size != 0)
+    sizep = &exec_hdr (stdoutput)->a_text;
+  if (sizep)
     {
-      bfd_size_type size;
-      do
+      bfd_size_type size = sec->size;
+      bfd_byte b = 0;
+
+      gas_assert (bfd_set_section_contents (stdoutput, sec, &b, size - 1, 1));
+
+      /* We don't know the aligned size until after VMAs and sizes are
+	 set on the bfd_set_section_contents call.  If that size is
+	 larger than the section then write again to ensure the file
+	 contents extend to cover the aligned size.  */
+      if (*sizep > size)
 	{
-	  bfd_byte b = 0;
-	  size = sec->size;
-	  gas_assert (bfd_set_section_contents (stdoutput, sec, &b,
-						size - 1, (bfd_size_type) 1));
-	} while (size != sec->size);
+	  file_ptr pos = sec->filepos + *sizep;
+
+	  gas_assert (bfd_seek (stdoutput, pos - 1, SEEK_SET) == 0
+		      && bfd_bwrite (&b, 1, stdoutput) == 1);
+	}
     }
 }