asan: readelf: wild read in get_num_dynamic_syms
authorAlan Modra <amodra@gmail.com>
Thu, 21 May 2020 00:18:35 +0000 (09:48 +0930)
committerAlan Modra <amodra@gmail.com>
Thu, 21 May 2020 00:41:57 +0000 (10:11 +0930)
* readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
access.

binutils/ChangeLog
binutils/readelf.c

index 2b903512bf56381e0560ba5c1444757e278d50df..e906bdf75c47f277ef482438b42d2a92f27377c4 100644 (file)
@@ -1,3 +1,8 @@
+2020-05-21  Alan Modra  <amodra@gmail.com>
+
+       * readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
+       access.
+
 2020-05-20  Nelson Chu  <nelson.chu@sifive.com>
 
        * dwarf.c: Updated since DECLARE_CSR is changed.
index 87bb574129fb5b67f2ddc1dde9f6fe45ed7da381..798782c3a8209c467a90c1d0fb4ab82d93865e49 100644 (file)
@@ -10211,7 +10211,8 @@ get_num_dynamic_syms (Filedata * filedata)
              {
                if (filedata->dynamic_info_DT_MIPS_XHASH)
                  {
-                   if (filedata->mipsxlat[off] >= num_of_syms)
+                   if (off < filedata->ngnuchains
+                       && filedata->mipsxlat[off] >= num_of_syms)
                      num_of_syms = filedata->mipsxlat[off] + 1;
                  }
                else