buffer overflow in score_elf_create_dynamic_relocation score_elf_create_dynamic_relocation sets up three output dynamic relocs from rel[0], rel[1] and rel[2]. When rel[0] is the last reloc in a section this of course results in a buffer overflow. It's a weird thing to do given that only one relocation is output. * elf32-score.c (score_elf_create_dynamic_relocation): Do not set up three dynamic relocations when only one is output. * elf32-score7.c: Likewise.