From: Alan Modra <amodra@gmail.com>
Date: Thu, 21 May 2020 00:18:35 +0000 (+0930)
Subject: asan: readelf: wild read in get_num_dynamic_syms
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=c31ab5a0010ac9e3d31fd218fffcff1b9696363e;p=binutils-gdb.git

asan: readelf: wild read in get_num_dynamic_syms

	* readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
	access.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 2b903512bf5..e906bdf75c4 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2020-05-21  Alan Modra  <amodra@gmail.com>
+
+	* readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
+	access.
+
 2020-05-20  Nelson Chu  <nelson.chu@sifive.com>
 
 	* dwarf.c: Updated since DECLARE_CSR is changed.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 87bb574129f..798782c3a82 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -10211,7 +10211,8 @@ get_num_dynamic_syms (Filedata * filedata)
 	      {
 		if (filedata->dynamic_info_DT_MIPS_XHASH)
 		  {
-		    if (filedata->mipsxlat[off] >= num_of_syms)
+		    if (off < filedata->ngnuchains
+			&& filedata->mipsxlat[off] >= num_of_syms)
 		      num_of_syms = filedata->mipsxlat[off] + 1;
 		  }
 		else