Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/elfutils/patches/elfutils-0.108-robustify3.patch

    Annotation of /trunk/elfutils/patches/elfutils-0.108-robustify3.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 144 - (hide annotations) (download)
    Tue May 8 20:06:05 2007 UTC (17 years, 1 month ago) by niro
    File size: 67237 byte(s) 
    -import
    1 niro 144 src/
    2     2005-06-09 Roland McGrath <roland@redhat.com>
    3    
    4     * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
    5     (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
    6     (handle_scngrp): Check for bogus sh_info.
    7    
    8     * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
    9     st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
    10     Don't use assert on input values, instead bail with "illformed" error.
    11    
    12     2005-05-17 Jakub Jelinek <jakub@redhat.com>
    13    
    14     libelf/
    15     * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
    16     table fits into object's bounds.
    17     * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
    18     elf->map_address. Check if first section header fits into object's
    19     bounds.
    20     * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Fix comment pasto.
    21     Check if section header table fits into object's bounds.
    22     * elf_begin.c (get_shnum): Fail if maxsize is smaller than ELF headers.
    23     Ensure first section header fits into object's bounds.
    24     (file_read_elf): Make sure scncnt is small enough to allocate both
    25     ElfXX_Shdr and Elf_Scn array. Make sure section and program header
    26     tables fit into object's bounds. Avoid memory leak on failure.
    27    
    28     src/
    29     * elflint.c (check_hash): Don't check entries beyond end of section.
    30     (check_note): Don't crash if gelf_rawchunk fails.
    31     (section_name): Return <invalid> if gelf_getshdr returns NULL.
    32    
    33     2005-05-14 Jakub Jelinek <jakub@redhat.com>
    34    
    35     libelf/
    36     * libelfP.h (INVALID_NDX): Define.
    37     * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
    38     * gelf_getlib.c (gelf_getlib): Likewise.
    39     * gelf_getmove.c (gelf_getmove): Likewise.
    40     * gelf_getrel.c (gelf_getrel): Likewise.
    41     * gelf_getrela.c (gelf_getrela): Likewise.
    42     * gelf_getsym.c (gelf_getsym): Likewise.
    43     * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
    44     * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
    45     * gelf_getversym.c (gelf_getversym): Likewise.
    46     * gelf_update_dyn.c (gelf_update_dyn): Likewise.
    47     * gelf_update_lib.c (gelf_update_lib): Likewise.
    48     * gelf_update_move.c (gelf_update_move): Likewise.
    49     * gelf_update_rel.c (gelf_update_rel): Likewise.
    50     * gelf_update_rela.c (gelf_update_rela): Likewise.
    51     * gelf_update_sym.c (gelf_update_sym): Likewise.
    52     * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
    53     * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
    54     * gelf_update_versym.c (gelf_update_versym): Likewise.
    55     * elf_newscn.c (elf_newscn): Check for overflow.
    56     * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
    57     (__elfw2(LIBELFBITS,updatefile)): Likewise.
    58     * elf_begin.c (file_read_elf): Likewise.
    59     * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
    60     * elf_getarsym.c (elf_getarsym): Likewise.
    61     * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
    62     src/
    63     * elflint.c (section_name): Return "<invalid>" instead of
    64     crashing on invalid section name.
    65     (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
    66     check_symtab_shndx, check_hash, check_versym): Robustify.
    67    
    68     --- elfutils-0.108/libelf/gelf_getrel.c.jj 2004-01-05 21:45:05.000000000 +0100
    69     +++ elfutils-0.108/libelf/gelf_getrel.c 2005-05-14 01:31:25.000000000 +0200
    70     @@ -1,5 +1,5 @@
    71     /* Get REL relocation information at given index.
    72     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    73     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    74     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    75    
    76     This program is free software; you can redistribute it and/or modify
    77     @@ -38,12 +38,6 @@ gelf_getrel (data, ndx, dst)
    78     if (data_scn == NULL)
    79     return NULL;
    80    
    81     - if (unlikely (ndx < 0))
    82     - {
    83     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    84     - return NULL;
    85     - }
    86     -
    87     if (unlikely (data_scn->d.d_type != ELF_T_REL))
    88     {
    89     __libelf_seterrno (ELF_E_INVALID_HANDLE);
    90     @@ -60,7 +54,8 @@ gelf_getrel (data, ndx, dst)
    91     if (scn->elf->class == ELFCLASS32)
    92     {
    93     /* We have to convert the data. */
    94     - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    95     + if (INVALID_NDX (ndx, Elf32_Rel)
    96     + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    97     {
    98     __libelf_seterrno (ELF_E_INVALID_INDEX);
    99     result = NULL;
    100     @@ -80,7 +75,8 @@ gelf_getrel (data, ndx, dst)
    101     {
    102     /* Simply copy the data after we made sure we are actually getting
    103     correct data. */
    104     - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    105     + if (INVALID_NDX (ndx, Elf64_Rel)
    106     + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    107     {
    108     __libelf_seterrno (ELF_E_INVALID_INDEX);
    109     result = NULL;
    110     --- elfutils-0.108/libelf/gelf_getsym.c.jj 2004-01-05 21:45:05.000000000 +0100
    111     +++ elfutils-0.108/libelf/gelf_getsym.c 2005-05-14 01:31:25.000000000 +0200
    112     @@ -1,5 +1,5 @@
    113     /* Get symbol information from symbol table at the given index.
    114     - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
    115     + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    116     Written by Ulrich Drepper <drepper@redhat.com>, 1999.
    117    
    118     This program is free software; you can redistribute it and/or modify
    119     @@ -57,7 +57,8 @@ gelf_getsym (data, ndx, dst)
    120     table entries has to be adopted. The user better has provided
    121     a buffer where we can store the information. While copying the
    122     data we are converting the format. */
    123     - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    124     + if (INVALID_NDX (ndx, Elf32_Sym)
    125     + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    126     {
    127     __libelf_seterrno (ELF_E_INVALID_INDEX);
    128     goto out;
    129     @@ -86,7 +87,8 @@ gelf_getsym (data, ndx, dst)
    130    
    131     /* The data is already in the correct form. Just make sure the
    132     index is OK. */
    133     - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    134     + if (INVALID_NDX (ndx, GElf_Sym)
    135     + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    136     {
    137     __libelf_seterrno (ELF_E_INVALID_INDEX);
    138     goto out;
    139     --- elfutils-0.108/libelf/gelf_update_sym.c.jj 2004-01-05 21:45:05.000000000 +0100
    140     +++ elfutils-0.108/libelf/gelf_update_sym.c 2005-05-14 01:31:25.000000000 +0200
    141     @@ -1,5 +1,5 @@
    142     /* Update symbol information in symbol table at the given index.
    143     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    144     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    145     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    146    
    147     This program is free software; you can redistribute it and/or modify
    148     @@ -39,12 +39,6 @@ gelf_update_sym (data, ndx, src)
    149     if (data == NULL)
    150     return 0;
    151    
    152     - if (unlikely (ndx < 0))
    153     - {
    154     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    155     - return 0;
    156     - }
    157     -
    158     if (unlikely (data_scn->d.d_type != ELF_T_SYM))
    159     {
    160     /* The type of the data better should match. */
    161     @@ -69,7 +63,8 @@ gelf_update_sym (data, ndx, src)
    162     }
    163    
    164     /* Check whether we have to resize the data buffer. */
    165     - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    166     + if (INVALID_NDX (ndx, Elf32_Sym)
    167     + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    168     {
    169     __libelf_seterrno (ELF_E_INVALID_INDEX);
    170     goto out;
    171     @@ -92,7 +87,8 @@ gelf_update_sym (data, ndx, src)
    172     else
    173     {
    174     /* Check whether we have to resize the data buffer. */
    175     - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    176     + if (INVALID_NDX (ndx, Elf64_Sym)
    177     + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    178     {
    179     __libelf_seterrno (ELF_E_INVALID_INDEX);
    180     goto out;
    181     --- elfutils-0.108/libelf/gelf_getrela.c.jj 2004-01-05 21:45:05.000000000 +0100
    182     +++ elfutils-0.108/libelf/gelf_getrela.c 2005-05-14 01:31:25.000000000 +0200
    183     @@ -1,5 +1,5 @@
    184     /* Get RELA relocation information at given index.
    185     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    186     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    187     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    188    
    189     This program is free software; you can redistribute it and/or modify
    190     @@ -38,12 +38,6 @@ gelf_getrela (data, ndx, dst)
    191     if (data_scn == NULL)
    192     return NULL;
    193    
    194     - if (unlikely (ndx < 0))
    195     - {
    196     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    197     - return NULL;
    198     - }
    199     -
    200     if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    201     {
    202     __libelf_seterrno (ELF_E_INVALID_HANDLE);
    203     @@ -60,7 +54,8 @@ gelf_getrela (data, ndx, dst)
    204     if (scn->elf->class == ELFCLASS32)
    205     {
    206     /* We have to convert the data. */
    207     - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    208     + if (INVALID_NDX (ndx, Elf32_Rela)
    209     + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    210     {
    211     __libelf_seterrno (ELF_E_INVALID_INDEX);
    212     result = NULL;
    213     @@ -81,7 +76,8 @@ gelf_getrela (data, ndx, dst)
    214     {
    215     /* Simply copy the data after we made sure we are actually getting
    216     correct data. */
    217     - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    218     + if (INVALID_NDX (ndx, Elf64_Rela)
    219     + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    220     {
    221     __libelf_seterrno (ELF_E_INVALID_INDEX);
    222     result = NULL;
    223     --- elfutils-0.108/libelf/gelf_update_syminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
    224     +++ elfutils-0.108/libelf/gelf_update_syminfo.c 2005-05-14 01:31:25.000000000 +0200
    225     @@ -1,5 +1,5 @@
    226     /* Update additional symbol information in symbol table at the given index.
    227     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    228     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    229     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    230    
    231     This program is free software; you can redistribute it and/or modify
    232     @@ -39,12 +39,6 @@ gelf_update_syminfo (data, ndx, src)
    233     if (data == NULL)
    234     return 0;
    235    
    236     - if (unlikely (ndx < 0))
    237     - {
    238     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    239     - return 0;
    240     - }
    241     -
    242     if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
    243     {
    244     /* The type of the data better should match. */
    245     @@ -60,7 +54,8 @@ gelf_update_syminfo (data, ndx, src)
    246     rwlock_wrlock (scn->elf->lock);
    247    
    248     /* Check whether we have to resize the data buffer. */
    249     - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    250     + if (INVALID_NDX (ndx, GElf_Syminfo)
    251     + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    252     {
    253     __libelf_seterrno (ELF_E_INVALID_INDEX);
    254     goto out;
    255     --- elfutils-0.108/libelf/gelf_getsyminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
    256     +++ elfutils-0.108/libelf/gelf_getsyminfo.c 2005-05-14 01:31:25.000000000 +0200
    257     @@ -1,5 +1,5 @@
    258     /* Get additional symbol information from symbol table at the given index.
    259     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    260     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    261     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    262    
    263     This program is free software; you can redistribute it and/or modify
    264     @@ -51,7 +51,8 @@ gelf_getsyminfo (data, ndx, dst)
    265    
    266     /* The data is already in the correct form. Just make sure the
    267     index is OK. */
    268     - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    269     + if (INVALID_NDX (ndx, GElf_Syminfo)
    270     + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    271     {
    272     __libelf_seterrno (ELF_E_INVALID_INDEX);
    273     goto out;
    274     --- elfutils-0.108/libelf/elf_newscn.c.jj 2004-01-05 21:45:05.000000000 +0100
    275     +++ elfutils-0.108/libelf/elf_newscn.c 2005-05-14 01:38:35.000000000 +0200
    276     @@ -1,5 +1,5 @@
    277     /* Append new section.
    278     - Copyright (C) 1998, 1999, 2000, 2001, 2002 Red Hat, Inc.
    279     + Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    280     Written by Ulrich Drepper <drepper@redhat.com>, 1998.
    281    
    282     This program is free software; you can redistribute it and/or modify
    283     @@ -71,13 +71,21 @@ elf_newscn (elf)
    284     else
    285     {
    286     /* We must allocate a new element. */
    287     - Elf_ScnList *newp;
    288     + Elf_ScnList *newp = NULL;
    289    
    290     assert (elf->state.elf.scnincr > 0);
    291    
    292     - newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
    293     - + ((elf->state.elf.scnincr *= 2)
    294     - * sizeof (Elf_Scn)), 1);
    295     + if (
    296     +#if SIZE_MAX <= 4294967295U
    297     + likely (elf->state.elf.scnincr
    298     + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
    299     +#else
    300     + 1
    301     +#endif
    302     + )
    303     + newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
    304     + + ((elf->state.elf.scnincr *= 2)
    305     + * sizeof (Elf_Scn)), 1);
    306     if (newp == NULL)
    307     {
    308     __libelf_seterrno (ELF_E_NOMEM);
    309     --- elfutils-0.108/libelf/gelf_update_lib.c.jj 2004-01-23 19:23:03.000000000 +0100
    310     +++ elfutils-0.108/libelf/gelf_update_lib.c 2005-05-14 01:31:25.000000000 +0200
    311     @@ -1,5 +1,5 @@
    312     /* Update library in table at the given index.
    313     - Copyright (C) 2004 Red Hat, Inc.
    314     + Copyright (C) 2004, 2005 Red Hat, Inc.
    315     Written by Ulrich Drepper <drepper@redhat.com>, 2004.
    316    
    317     This program is free software; you can redistribute it and/or modify
    318     @@ -35,12 +35,6 @@ gelf_update_lib (data, ndx, src)
    319     if (data == NULL)
    320     return 0;
    321    
    322     - if (unlikely (ndx < 0))
    323     - {
    324     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    325     - return 0;
    326     - }
    327     -
    328     Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
    329     if (unlikely (data_scn->d.d_type != ELF_T_LIB))
    330     {
    331     @@ -54,7 +48,8 @@ gelf_update_lib (data, ndx, src)
    332    
    333     /* Check whether we have to resize the data buffer. */
    334     int result = 0;
    335     - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    336     + if (INVALID_NDX (ndx, Elf64_Lib)
    337     + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    338     __libelf_seterrno (ELF_E_INVALID_INDEX);
    339     else
    340     {
    341     --- elfutils-0.108/libelf/gelf_getmove.c.jj 2004-01-05 21:45:05.000000000 +0100
    342     +++ elfutils-0.108/libelf/gelf_getmove.c 2005-05-14 01:31:25.000000000 +0200
    343     @@ -1,5 +1,5 @@
    344     /* Get move structure at the given index.
    345     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    346     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    347     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    348    
    349     This program is free software; you can redistribute it and/or modify
    350     @@ -50,7 +50,8 @@ gelf_getmove (data, ndx, dst)
    351    
    352     /* The data is already in the correct form. Just make sure the
    353     index is OK. */
    354     - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    355     + if (INVALID_NDX (ndx, GElf_Move)
    356     + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    357     {
    358     __libelf_seterrno (ELF_E_INVALID_INDEX);
    359     goto out;
    360     --- elfutils-0.108/libelf/elf32_updatefile.c.jj 2005-02-06 10:14:52.000000000 +0100
    361     +++ elfutils-0.108/libelf/elf32_updatefile.c 2005-05-14 00:45:03.000000000 +0200
    362     @@ -164,6 +164,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf
    363     /* Write all the sections. Well, only those which are modified. */
    364     if (shnum > 0)
    365     {
    366     + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
    367     + return 1;
    368     +
    369     ElfW2(LIBELFBITS,Shdr) *shdr_dest;
    370     Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
    371     Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
    372     @@ -468,6 +471,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf
    373     /* Write all the sections. Well, only those which are modified. */
    374     if (shnum > 0)
    375     {
    376     + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
    377     + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
    378     + return 1;
    379     +
    380     off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
    381     #if EV_NUM != 2
    382     xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
    383     --- elfutils-0.108/libelf/gelf_getsymshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    384     +++ elfutils-0.108/libelf/gelf_getsymshndx.c 2005-05-14 01:31:25.000000000 +0200
    385     @@ -1,6 +1,6 @@
    386     /* Get symbol information and separate section index from symbol table
    387     at the given index.
    388     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    389     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    390     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    391    
    392     This program is free software; you can redistribute it and/or modify
    393     @@ -57,7 +57,9 @@ gelf_getsymshndx (symdata, shndxdata, nd
    394     section index table. */
    395     if (likely (shndxdata_scn != NULL))
    396     {
    397     - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
    398     + if (INVALID_NDX (ndx, Elf32_Word)
    399     + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
    400     + > shndxdata_scn->d.d_size))
    401     {
    402     __libelf_seterrno (ELF_E_INVALID_INDEX);
    403     goto out;
    404     @@ -77,7 +79,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    405     table entries has to be adopted. The user better has provided
    406     a buffer where we can store the information. While copying the
    407     data we are converting the format. */
    408     - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    409     + if (INVALID_NDX (ndx, Elf32_Sym)
    410     + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    411     {
    412     __libelf_seterrno (ELF_E_INVALID_INDEX);
    413     goto out;
    414     @@ -106,7 +109,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    415    
    416     /* The data is already in the correct form. Just make sure the
    417     index is OK. */
    418     - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    419     + if (INVALID_NDX (ndx, GElf_Sym)
    420     + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    421     {
    422     __libelf_seterrno (ELF_E_INVALID_INDEX);
    423     goto out;
    424     --- elfutils-0.108/libelf/gelf_update_move.c.jj 2004-01-05 21:45:05.000000000 +0100
    425     +++ elfutils-0.108/libelf/gelf_update_move.c 2005-05-14 01:31:25.000000000 +0200
    426     @@ -1,5 +1,5 @@
    427     /* Update move structure at the given index.
    428     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    429     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    430     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    431    
    432     This program is free software; you can redistribute it and/or modify
    433     @@ -42,7 +42,7 @@ gelf_update_move (data, ndx, src)
    434     assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
    435    
    436     /* Check whether we have to resize the data buffer. */
    437     - if (unlikely (ndx < 0)
    438     + if (INVALID_NDX (ndx, GElf_Move)
    439     || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
    440     {
    441     __libelf_seterrno (ELF_E_INVALID_INDEX);
    442     --- elfutils-0.108/libelf/gelf_update_dyn.c.jj 2004-01-05 21:45:05.000000000 +0100
    443     +++ elfutils-0.108/libelf/gelf_update_dyn.c 2005-05-14 01:31:25.000000000 +0200
    444     @@ -1,5 +1,5 @@
    445     /* Update information in dynamic table at the given index.
    446     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    447     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    448     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    449    
    450     This program is free software; you can redistribute it and/or modify
    451     @@ -38,12 +38,6 @@ gelf_update_dyn (data, ndx, src)
    452     if (data == NULL)
    453     return 0;
    454    
    455     - if (unlikely (ndx < 0))
    456     - {
    457     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    458     - return 0;
    459     - }
    460     -
    461     if (unlikely (data_scn->d.d_type != ELF_T_DYN))
    462     {
    463     /* The type of the data better should match. */
    464     @@ -69,7 +63,8 @@ gelf_update_dyn (data, ndx, src)
    465     }
    466    
    467     /* Check whether we have to resize the data buffer. */
    468     - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    469     + if (INVALID_NDX (ndx, Elf32_Dyn)
    470     + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    471     {
    472     __libelf_seterrno (ELF_E_INVALID_INDEX);
    473     goto out;
    474     @@ -83,7 +78,8 @@ gelf_update_dyn (data, ndx, src)
    475     else
    476     {
    477     /* Check whether we have to resize the data buffer. */
    478     - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    479     + if (INVALID_NDX (ndx, Elf64_Dyn)
    480     + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    481     {
    482     __libelf_seterrno (ELF_E_INVALID_INDEX);
    483     goto out;
    484     --- elfutils-0.108/libelf/gelf_getversym.c.jj 2004-01-05 21:45:05.000000000 +0100
    485     +++ elfutils-0.108/libelf/gelf_getversym.c 2005-05-14 01:31:25.000000000 +0200
    486     @@ -1,5 +1,5 @@
    487     /* Get symbol version information at the given index.
    488     - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
    489     + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    490     Written by Ulrich Drepper <drepper@redhat.com>, 1999.
    491    
    492     This program is free software; you can redistribute it and/or modify
    493     @@ -59,7 +59,8 @@ gelf_getversym (data, ndx, dst)
    494    
    495     /* The data is already in the correct form. Just make sure the
    496     index is OK. */
    497     - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    498     + if (INVALID_NDX (ndx, GElf_Versym)
    499     + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    500     {
    501     __libelf_seterrno (ELF_E_INVALID_INDEX);
    502     result = NULL;
    503     --- elfutils-0.108/libelf/elf32_newphdr.c.jj 2004-01-05 21:45:05.000000000 +0100
    504     +++ elfutils-0.108/libelf/elf32_newphdr.c 2005-05-14 01:17:53.000000000 +0200
    505     @@ -1,5 +1,5 @@
    506     /* Create new ELF program header table.
    507     - Copyright (C) 1999, 2000, 2002 Red Hat, Inc.
    508     + Copyright (C) 1999, 2000, 2002, 2005 Red Hat, Inc.
    509     Written by Ulrich Drepper <drepper@redhat.com>, 1998.
    510    
    511     This program is free software; you can redistribute it and/or modify
    512     @@ -91,6 +91,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count)
    513     else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
    514     || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
    515     {
    516     + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
    517     + {
    518     + result = NULL;
    519     + goto out;
    520     + }
    521     +
    522     /* Allocate a new program header with the appropriate number of
    523     elements. */
    524     result = (ElfW2(LIBELFBITS,Phdr) *)
    525     --- elfutils-0.108/libelf/gelf_getdyn.c.jj 2004-01-05 21:45:05.000000000 +0100
    526     +++ elfutils-0.108/libelf/gelf_getdyn.c 2005-05-14 01:31:25.000000000 +0200
    527     @@ -1,5 +1,5 @@
    528     /* Get information from dynamic table at the given index.
    529     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    530     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    531     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    532    
    533     This program is free software; you can redistribute it and/or modify
    534     @@ -60,7 +60,8 @@ gelf_getdyn (data, ndx, dst)
    535     table entries has to be adopted. The user better has provided
    536     a buffer where we can store the information. While copying the
    537     data we are converting the format. */
    538     - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    539     + if (INVALID_NDX (ndx, Elf32_Dyn)
    540     + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    541     {
    542     __libelf_seterrno (ELF_E_INVALID_INDEX);
    543     goto out;
    544     @@ -81,7 +82,8 @@ gelf_getdyn (data, ndx, dst)
    545    
    546     /* The data is already in the correct form. Just make sure the
    547     index is OK. */
    548     - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    549     + if (INVALID_NDX (ndx, GElf_Dyn)
    550     + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    551     {
    552     __libelf_seterrno (ELF_E_INVALID_INDEX);
    553     goto out;
    554     --- elfutils-0.108/libelf/elf_getarsym.c.jj 2005-02-06 10:14:52.000000000 +0100
    555     +++ elfutils-0.108/libelf/elf_getarsym.c 2005-05-14 01:37:47.000000000 +0200
    556     @@ -144,6 +144,9 @@ elf_getarsym (elf, ptr)
    557     size_t index_size = atol (tmpbuf);
    558    
    559     if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
    560     +#if SIZE_MAX <= 4294967295U
    561     + || n >= SIZE_MAX / sizeof (Elf_Arsym)
    562     +#endif
    563     || n * sizeof (uint32_t) > index_size)
    564     {
    565     /* This index table cannot be right since it does not fit into
    566     --- elfutils-0.108/libelf/libelfP.h.jj 2005-03-30 03:42:32.000000000 +0200
    567     +++ elfutils-0.108/libelf/libelfP.h 2005-05-14 01:28:47.000000000 +0200
    568     @@ -531,4 +531,13 @@ extern uint32_t __libelf_crc32 (uint32_t
    569     } while (0)
    570     #endif
    571    
    572     +/* Convenience macro. Assumes int NDX and TYPE with size at least
    573     + 2 bytes. */
    574     +#if SIZE_MAX > 4294967295U
    575     +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
    576     +#else
    577     +# define INVALID_NDX(ndx, type) \
    578     + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
    579     +#endif
    580     +
    581     #endif /* libelfP.h */
    582     --- elfutils-0.108/libelf/gelf_getlib.c.jj 2004-01-23 19:22:56.000000000 +0100
    583     +++ elfutils-0.108/libelf/gelf_getlib.c 2005-05-14 01:31:25.000000000 +0200
    584     @@ -1,5 +1,5 @@
    585     /* Get library from table at the given index.
    586     - Copyright (C) 2004 Red Hat, Inc.
    587     + Copyright (C) 2004, 2005 Red Hat, Inc.
    588     Written by Ulrich Drepper <drepper@redhat.com>, 2004.
    589    
    590     This program is free software; you can redistribute it and/or modify
    591     @@ -53,7 +53,8 @@ gelf_getlib (data, ndx, dst)
    592     /* The data is already in the correct form. Just make sure the
    593     index is OK. */
    594     GElf_Lib *result = NULL;
    595     - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    596     + if (INVALID_NDX (ndx, GElf_Lib)
    597     + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    598     __libelf_seterrno (ELF_E_INVALID_INDEX);
    599     else
    600     {
    601     --- elfutils-0.108/libelf/gelf_update_symshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    602     +++ elfutils-0.108/libelf/gelf_update_symshndx.c 2005-05-14 01:31:25.000000000 +0200
    603     @@ -1,6 +1,6 @@
    604     /* Update symbol information and section index in symbol table at the
    605     given index.
    606     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    607     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    608     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    609    
    610     This program is free software; you can redistribute it and/or modify
    611     @@ -44,12 +44,6 @@ gelf_update_symshndx (symdata, shndxdata
    612     if (symdata == NULL)
    613     return 0;
    614    
    615     - if (unlikely (ndx < 0))
    616     - {
    617     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    618     - return 0;
    619     - }
    620     -
    621     if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
    622     {
    623     /* The type of the data better should match. */
    624     @@ -95,7 +89,8 @@ gelf_update_symshndx (symdata, shndxdata
    625     }
    626    
    627     /* Check whether we have to resize the data buffer. */
    628     - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    629     + if (INVALID_NDX (ndx, Elf32_Sym)
    630     + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    631     {
    632     __libelf_seterrno (ELF_E_INVALID_INDEX);
    633     goto out;
    634     @@ -118,7 +113,8 @@ gelf_update_symshndx (symdata, shndxdata
    635     else
    636     {
    637     /* Check whether we have to resize the data buffer. */
    638     - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    639     + if (INVALID_NDX (ndx, Elf64_Sym)
    640     + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    641     {
    642     __libelf_seterrno (ELF_E_INVALID_INDEX);
    643     goto out;
    644     --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-02-06 10:14:52.000000000 +0100
    645     +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-14 00:32:57.000000000 +0200
    646     @@ -66,7 +66,8 @@ elfw2(LIBELFBITS,getshdr) (scn)
    647     goto out;
    648    
    649     size_t shnum;
    650     - if (INTUSE (elf_getshnum) (elf, &shnum) != 0)
    651     + if (INTUSE (elf_getshnum) (elf, &shnum) != 0
    652     + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
    653     goto out;
    654     size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
    655    
    656     --- elfutils-0.108/libelf/gelf_update_rela.c.jj 2004-01-05 21:45:05.000000000 +0100
    657     +++ elfutils-0.108/libelf/gelf_update_rela.c 2005-05-14 01:31:25.000000000 +0200
    658     @@ -1,5 +1,5 @@
    659     /* Update RELA relocation information at given index.
    660     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    661     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    662     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    663    
    664     This program is free software; you can redistribute it and/or modify
    665     @@ -35,12 +35,6 @@ gelf_update_rela (Elf_Data *dst, int ndx
    666     if (dst == NULL)
    667     return 0;
    668    
    669     - if (unlikely (ndx < 0))
    670     - {
    671     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    672     - return 0;
    673     - }
    674     -
    675     if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    676     {
    677     /* The type of the data better should match. */
    678     @@ -68,7 +62,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    679     }
    680    
    681     /* Check whether we have to resize the data buffer. */
    682     - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    683     + if (INVALID_NDX (ndx, Elf32_Rela)
    684     + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    685     {
    686     __libelf_seterrno (ELF_E_INVALID_INDEX);
    687     goto out;
    688     @@ -84,7 +79,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    689     else
    690     {
    691     /* Check whether we have to resize the data buffer. */
    692     - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    693     + if (INVALID_NDX (ndx, Elf64_Rela)
    694     + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    695     {
    696     __libelf_seterrno (ELF_E_INVALID_INDEX);
    697     goto out;
    698     --- elfutils-0.108/libelf/gelf_update_versym.c.jj 2004-01-05 21:45:05.000000000 +0100
    699     +++ elfutils-0.108/libelf/gelf_update_versym.c 2005-05-14 01:31:25.000000000 +0200
    700     @@ -1,5 +1,5 @@
    701     /* Update symbol version information.
    702     - Copyright (C) 2001, 2002 Red Hat, Inc.
    703     + Copyright (C) 2001, 2002, 2005 Red Hat, Inc.
    704     Written by Ulrich Drepper <drepper@redhat.com>, 2001.
    705    
    706     This program is free software; you can redistribute it and/or modify
    707     @@ -42,7 +42,7 @@ gelf_update_versym (data, ndx, src)
    708     assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
    709    
    710     /* Check whether we have to resize the data buffer. */
    711     - if (unlikely (ndx < 0)
    712     + if (INVALID_NDX (ndx, GElf_Versym)
    713     || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
    714     {
    715     __libelf_seterrno (ELF_E_INVALID_INDEX);
    716     --- elfutils-0.108/libelf/gelf_update_rel.c.jj 2004-01-05 21:45:05.000000000 +0100
    717     +++ elfutils-0.108/libelf/gelf_update_rel.c 2005-05-14 01:31:25.000000000 +0200
    718     @@ -1,5 +1,5 @@
    719     /* Update REL relocation information at given index.
    720     - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    721     + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    722     Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    723    
    724     This program is free software; you can redistribute it and/or modify
    725     @@ -35,12 +35,6 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    726     if (dst == NULL)
    727     return 0;
    728    
    729     - if (unlikely (ndx < 0))
    730     - {
    731     - __libelf_seterrno (ELF_E_INVALID_INDEX);
    732     - return 0;
    733     - }
    734     -
    735     if (unlikely (data_scn->d.d_type != ELF_T_REL))
    736     {
    737     /* The type of the data better should match. */
    738     @@ -66,7 +60,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    739     }
    740    
    741     /* Check whether we have to resize the data buffer. */
    742     - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    743     + if (INVALID_NDX (ndx, Elf32_Rel)
    744     + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    745     {
    746     __libelf_seterrno (ELF_E_INVALID_INDEX);
    747     goto out;
    748     @@ -81,7 +76,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    749     else
    750     {
    751     /* Check whether we have to resize the data buffer. */
    752     - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    753     + if (INVALID_NDX (ndx, Elf64_Rel)
    754     + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    755     {
    756     __libelf_seterrno (ELF_E_INVALID_INDEX);
    757     goto out;
    758     --- elfutils-0.108/src/elflint.c.jj 2005-05-07 01:46:26.000000000 +0200
    759     +++ elfutils-0.108/src/elflint.c 2005-05-14 02:22:24.000000000 +0200
    760     @@ -111,6 +111,9 @@ static uint32_t shstrndx;
    761     /* Array to count references in section groups. */
    762     static int *scnref;
    763    
    764     +/* Number of sections. */
    765     +static unsigned int shnum;
    766     +
    767    
    768     int
    769     main (int argc, char *argv[])
    770     @@ -300,10 +303,17 @@ section_name (Ebl *ebl, int idx)
    771     {
    772     GElf_Shdr shdr_mem;
    773     GElf_Shdr *shdr;
    774     + const char *ret;
    775     +
    776     + if ((unsigned int) idx > shnum)
    777     + return "<invalid>";
    778    
    779     shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
    780    
    781     - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    782     + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    783     + if (ret == NULL)
    784     + return "<invalid>";
    785     + return ret;
    786     }
    787    
    788    
    789     @@ -325,10 +335,6 @@ static const int valid_e_machine[] =
    790     (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
    791    
    792    
    793     -/* Number of sections. */
    794     -static unsigned int shnum;
    795     -
    796     -
    797     static void
    798     check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
    799     {
    800     @@ -608,7 +614,8 @@ check_symtab (Ebl *ebl, GElf_Ehdr *ehdr,
    801     xndxdata = NULL;
    802     }
    803    
    804     - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
    805     + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
    806     + if (shdr->sh_entsize != sh_entsize)
    807     ERROR (gettext ("\
    808     section [%2zu] '%s': entry size is does not match ElfXX_Sym\n"),
    809     cnt, section_name (ebl, cnt));
    810     @@ -646,7 +653,7 @@ section [%2d] '%s': XINDEX for zeroth en
    811     xndxscnidx, section_name (ebl, xndxscnidx));
    812     }
    813    
    814     - for (cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    815     + for (cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
    816     {
    817     sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
    818     if (sym == NULL)
    819     @@ -664,7 +671,8 @@ section [%2d] '%s': symbol %zu: invalid
    820     else
    821     {
    822     name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
    823     - assert (name != NULL);
    824     + assert (name != NULL
    825     + || strshdr->sh_type != SHT_STRTAB);
    826     }
    827    
    828     if (sym->st_shndx == SHN_XINDEX)
    829     @@ -954,7 +962,7 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
    830     const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
    831     assert (rcshdr != NULL);
    832    
    833     - if (rcshdr->sh_type == SHT_DYNAMIC)
    834     + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
    835     {
    836     /* Found the dynamic section. Look through it. */
    837     Elf_Data *d = elf_getdata (scn, NULL);
    838     @@ -964,14 +972,17 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
    839     {
    840     GElf_Dyn dyn_mem;
    841     GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
    842     - assert (dyn != NULL);
    843     +
    844     + if (dyn == NULL)
    845     + break;
    846    
    847     if (dyn->d_tag == DT_RELCOUNT)
    848     {
    849     /* Found it. One last check: does the number
    850     specified number of relative relocations exceed
    851     the total number of relocations? */
    852     - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
    853     + if (shdr->sh_entsize
    854     + && dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
    855     ERROR (gettext ("\
    856     section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
    857     idx, section_name (ebl, idx),
    858     @@ -1048,7 +1059,8 @@ section [%2d] '%s': no relocations for m
    859     }
    860     }
    861    
    862     - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT))
    863     + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
    864     + if (shdr->sh_entsize != sh_entsize)
    865     ERROR (gettext ("\
    866     section [%2d] '%s': section entry size does not match ElfXX_Rela\n"),
    867     idx, section_name (ebl, idx));
    868     @@ -1058,7 +1070,7 @@ section [%2d] '%s': section entry size d
    869     GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
    870     Elf_Data *symdata = elf_getdata (symscn, NULL);
    871    
    872     - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    873     + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    874     {
    875     GElf_Rela rela_mem;
    876     GElf_Rela *rela;
    877     @@ -1183,7 +1195,8 @@ section [%2d] '%s': no relocations for m
    878     }
    879     }
    880    
    881     - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT))
    882     + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
    883     + if (shdr->sh_entsize != sh_entsize)
    884     ERROR (gettext ("\
    885     section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
    886     idx, section_name (ebl, idx));
    887     @@ -1193,7 +1206,7 @@ section [%2d] '%s': section entry size d
    888     GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
    889     Elf_Data *symdata = elf_getdata (symscn, NULL);
    890    
    891     - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    892     + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    893     {
    894     GElf_Rel rel_mem;
    895     GElf_Rel *rel;
    896     @@ -1341,7 +1354,8 @@ section [%2d] '%s': referenced as string
    897     shdr->sh_link, section_name (ebl, shdr->sh_link),
    898     idx, section_name (ebl, idx));
    899    
    900     - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
    901     + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
    902     + if (shdr->sh_entsize != sh_entsize)
    903     ERROR (gettext ("\
    904     section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
    905     idx, section_name (ebl, idx));
    906     @@ -1351,7 +1365,7 @@ section [%2d] '%s': section entry size d
    907     idx, section_name (ebl, idx));
    908    
    909     bool non_null_warned = false;
    910     - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    911     + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    912     {
    913     GElf_Dyn dyn_mem;
    914     GElf_Dyn *dyn;
    915     @@ -1502,6 +1516,8 @@ section [%2d] '%s': entry size does not
    916     idx, section_name (ebl, idx));
    917    
    918     if (symshdr != NULL
    919     + && shdr->sh_entsize
    920     + && symshdr->sh_entsize
    921     && (shdr->sh_size / shdr->sh_entsize
    922     < symshdr->sh_size / symshdr->sh_entsize))
    923     ERROR (gettext ("\
    924     @@ -1530,6 +1546,12 @@ section [%2d] '%s': extended section ind
    925     }
    926    
    927     data = elf_getdata (scn, NULL);
    928     + if (data == NULL)
    929     + {
    930     + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
    931     + idx, section_name (ebl, idx));
    932     + return;
    933     + }
    934    
    935     if (*((Elf32_Word *) data->d_buf) != 0)
    936     ERROR (gettext ("symbol 0 should have zero extended section index\n"));
    937     @@ -1613,7 +1635,7 @@ section [%2d] '%s': hash table section i
    938     idx, section_name (ebl, idx), (long int) shdr->sh_size,
    939     (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
    940    
    941     - if (symshdr != NULL)
    942     + if (symshdr != NULL && symshdr->sh_entsize)
    943     {
    944     size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
    945     size_t cnt;
    946     @@ -1910,8 +1932,10 @@ section [%2d] '%s' refers in sh_link to
    947     return;
    948     }
    949    
    950     - if (shdr->sh_size / shdr->sh_entsize
    951     - != symshdr->sh_size / symshdr->sh_entsize)
    952     + if (shdr->sh_entsize
    953     + && symshdr->sh_entsize
    954     + && shdr->sh_size / shdr->sh_entsize
    955     + != symshdr->sh_size / symshdr->sh_entsize)
    956     ERROR (gettext ("\
    957     section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
    958     idx, section_name (ebl, idx),
    959    
    960     --- elfutils-0.108/libelf/elf32_getphdr.c.jj 2005-02-06 10:14:52.000000000 +0100
    961     +++ elfutils-0.108/libelf/elf32_getphdr.c 2005-05-17 16:53:41.000000000 +0200
    962     @@ -80,6 +80,16 @@ elfw2(LIBELFBITS,getphdr) (elf)
    963    
    964     if (elf->map_address != NULL)
    965     {
    966     + /* First see whether the information in the ELF header is
    967     + valid and it does not ask for too much. */
    968     + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
    969     + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
    970     + {
    971     + /* Something is wrong. */
    972     + __libelf_seterrno (ELF_E_INVALID_PHDR);
    973     + goto out;
    974     + }
    975     +
    976     /* All the data is already mapped. Use it. */
    977     if (ehdr->e_ident[EI_DATA] == MY_ELFDATA
    978     && (ALLOW_UNALIGNED
    979     --- elfutils-0.108/libelf/elf_getshstrndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    980     +++ elfutils-0.108/libelf/elf_getshstrndx.c 2005-05-17 15:42:32.000000000 +0200
    981     @@ -1,5 +1,5 @@
    982     /* Return section index of section header string table.
    983     - Copyright (C) 2002 Red Hat, Inc.
    984     + Copyright (C) 2002, 2005 Red Hat, Inc.
    985     Written by Ulrich Drepper <drepper@redhat.com>, 2002.
    986    
    987     This program is free software; you can redistribute it and/or modify
    988     @@ -90,10 +90,25 @@ elf_getshstrndx (elf, dst)
    989     if (elf->map_address != NULL
    990     && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    991     && (ALLOW_UNALIGNED
    992     - || (((size_t) ((char *) elf->map_address + offset))
    993     + || (((size_t) ((char *) elf->map_address
    994     + + elf->start_offset + offset))
    995     & (__alignof__ (Elf32_Shdr) - 1)) == 0))
    996     - /* We can directly access the memory. */
    997     - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
    998     + {
    999     + /* First see whether the information in the ELF header is
    1000     + valid and it does not ask for too much. */
    1001     + if (unlikely (offset + sizeof (Elf32_Shdr)
    1002     + > elf->maximum_size))
    1003     + {
    1004     + /* Something is wrong. */
    1005     + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1006     + result = -1;
    1007     + goto out;
    1008     + }
    1009     +
    1010     + /* We can directly access the memory. */
    1011     + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
    1012     + + offset))->sh_link;
    1013     + }
    1014     else
    1015     {
    1016     /* We avoid reading in all the section headers. Just read
    1017     @@ -129,10 +144,25 @@ elf_getshstrndx (elf, dst)
    1018     if (elf->map_address != NULL
    1019     && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    1020     && (ALLOW_UNALIGNED
    1021     - || (((size_t) ((char *) elf->map_address + offset))
    1022     + || (((size_t) ((char *) elf->map_address
    1023     + + elf->start_offset + offset))
    1024     & (__alignof__ (Elf64_Shdr) - 1)) == 0))
    1025     - /* We can directly access the memory. */
    1026     - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
    1027     + {
    1028     + /* First see whether the information in the ELF header is
    1029     + valid and it does not ask for too much. */
    1030     + if (unlikely (offset + sizeof (Elf64_Shdr)
    1031     + > elf->maximum_size))
    1032     + {
    1033     + /* Something is wrong. */
    1034     + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1035     + result = -1;
    1036     + goto out;
    1037     + }
    1038     +
    1039     + /* We can directly access the memory. */
    1040     + num = ((Elf64_Shdr *) (elf->map_address
    1041     + + elf->start_offset + offset))->sh_link;
    1042     + }
    1043     else
    1044     {
    1045     /* We avoid reading in all the section headers. Just read
    1046     --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-05-14 00:32:57.000000000 +0200
    1047     +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-17 15:27:52.000000000 +0200
    1048     @@ -71,7 +71,7 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1049     goto out;
    1050     size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
    1051    
    1052     - /* Allocate memory for the program headers. We know the number
    1053     + /* Allocate memory for the section headers. We know the number
    1054     of entries from the ELF header. */
    1055     ElfW2(LIBELFBITS,Shdr) *shdr = elf->state.ELFW(elf,LIBELFBITS).shdr =
    1056     (ElfW2(LIBELFBITS,Shdr) *) malloc (size);
    1057     @@ -93,6 +93,16 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1058     && (ehdr->e_shoff
    1059     & (__alignof__ (ElfW2(LIBELFBITS,Shdr)) - 1)) != 0));
    1060    
    1061     + /* First see whether the information in the ELF header is
    1062     + valid and it does not ask for too much. */
    1063     + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
    1064     + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
    1065     + {
    1066     + /* Something is wrong. */
    1067     + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1068     + goto free_and_out;
    1069     + }
    1070     +
    1071     /* Now copy the data and at the same time convert the byte
    1072     order. */
    1073     if (ALLOW_UNALIGNED
    1074     --- elfutils-0.108/libelf/elf_begin.c.jj 2005-05-17 16:18:51.000000000 +0200
    1075     +++ elfutils-0.108/libelf/elf_begin.c 2005-05-17 17:31:37.000000000 +0200
    1076     @@ -77,7 +77,11 @@ get_shnum (void *map_address, unsigned c
    1077     || (((size_t) ((char *) map_address + offset))
    1078     & ((is32 ? __alignof__ (Elf32_Ehdr) : __alignof__ (Elf64_Ehdr))
    1079     - 1)) == 0))
    1080     - ehdr.p = (char *) map_address + offset;
    1081     + {
    1082     + ehdr.p = (char *) map_address + offset;
    1083     + if (maxsize < (is32 ? sizeof (Elf32_Ehdr) : sizeof (Elf64_Ehdr)))
    1084     + return (size_t) -1l;
    1085     + }
    1086     else
    1087     {
    1088     /* We have to read the data from the file. */
    1089     @@ -111,7 +115,8 @@ get_shnum (void *map_address, unsigned c
    1090    
    1091     if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
    1092     {
    1093     - if (offset + ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
    1094     + if (unlikely (ehdr.e32->e_shoff >= maxsize)
    1095     + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
    1096     /* Cannot read the first section header. */
    1097     return (size_t) -1l;
    1098    
    1099     @@ -147,7 +152,8 @@ get_shnum (void *map_address, unsigned c
    1100    
    1101     if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
    1102     {
    1103     - if (offset + ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
    1104     + if (unlikely (ehdr.e64->e_shoff >= maxsize)
    1105     + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
    1106     /* Cannot read the first section header. */
    1107     return (size_t) -1l;
    1108    
    1109     @@ -224,6 +226,15 @@ file_read_elf (int fildes, void *map_add
    1110     /* Could not determine the number of sections. */
    1111     return NULL;
    1112    
    1113     + /* Check for too many sections. */
    1114     + if (e_ident[EI_CLASS] == ELFCLASS32)
    1115     + {
    1116     + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
    1117     + return NULL;
    1118     + }
    1119     + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
    1120     + return NULL;
    1121     +
    1122     /* We can now allocate the memory. */
    1123     elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
    1124     ELF_K_ELF, scncnt * sizeof (Elf_Scn));
    1125     @@ -255,15 +270,31 @@ file_read_elf (int fildes, void *map_add
    1126     /* We can use the mmapped memory. */
    1127     elf->state.elf32.ehdr =
    1128     (Elf32_Ehdr *) ((char *) map_address + offset);
    1129     + if (unlikely (elf->state.elf32.ehdr->e_shoff >= maxsize)
    1130     + || unlikely (elf->state.elf32.ehdr->e_shoff
    1131     + + scncnt * sizeof (Elf32_Shdr) > maxsize))
    1132     + {
    1133     + free_and_out:
    1134     + __libelf_seterrno (ELF_E_INVALID_FILE);
    1135     + free (elf);
    1136     + return NULL;
    1137     + }
    1138     elf->state.elf32.shdr =
    1139     (Elf32_Shdr *) ((char *) map_address + offset
    1140     + elf->state.elf32.ehdr->e_shoff);
    1141     if (elf->state.elf32.ehdr->e_phnum)
    1142     - /* Assign a value only if there really is a program
    1143     - header. Otherwise the value remains NULL. */
    1144     - elf->state.elf32.phdr
    1145     - = (Elf32_Phdr *) ((char *) map_address + offset
    1146     - + elf->state.elf32.ehdr->e_phoff);
    1147     + {
    1148     + /* Assign a value only if there really is a program
    1149     + header. Otherwise the value remains NULL. */
    1150     + if (unlikely (elf->state.elf32.ehdr->e_phoff >= maxsize)
    1151     + || unlikely (elf->state.elf32.ehdr->e_phoff
    1152     + + elf->state.elf32.ehdr->e_phnum
    1153     + * sizeof (Elf32_Phdr) > maxsize))
    1154     + goto free_and_out;
    1155     + elf->state.elf32.phdr
    1156     + = (Elf32_Phdr *) ((char *) map_address + offset
    1157     + + elf->state.elf32.ehdr->e_phoff);
    1158     + }
    1159    
    1160     for (size_t cnt = 0; cnt < scncnt; ++cnt)
    1161     {
    1162     @@ -285,8 +316,7 @@ file_read_elf (int fildes, void *map_add
    1163     sizeof (Elf32_Ehdr), offset) != sizeof (Elf32_Ehdr))
    1164     {
    1165     /* We must be able to read the ELF header. */
    1166     - __libelf_seterrno (ELF_E_INVALID_FILE);
    1167     - return NULL;
    1168     + goto free_and_out;
    1169     }
    1170    
    1171     if (e_ident[EI_DATA] != MY_ELFDATA)
    1172     @@ -340,15 +370,26 @@ file_read_elf (int fildes, void *map_add
    1173     /* We can use the mmapped memory. */
    1174     elf->state.elf64.ehdr =
    1175     (Elf64_Ehdr *) ((char *) map_address + offset);
    1176     + if (unlikely (elf->state.elf64.ehdr->e_shoff >= maxsize)
    1177     + || unlikely (elf->state.elf64.ehdr->e_shoff
    1178     + + scncnt * sizeof (Elf64_Shdr) > maxsize))
    1179     + goto free_and_out;
    1180     elf->state.elf64.shdr =
    1181     (Elf64_Shdr *) ((char *) map_address + offset
    1182     + elf->state.elf64.ehdr->e_shoff);
    1183     if (elf->state.elf64.ehdr->e_phnum)
    1184     - /* Assign a value only if there really is a program
    1185     - header. Otherwise the value remains NULL. */
    1186     - elf->state.elf64.phdr
    1187     - = (Elf64_Phdr *) ((char *) map_address + offset
    1188     - + elf->state.elf64.ehdr->e_phoff);
    1189     + {
    1190     + /* Assign a value only if there really is a program
    1191     + header. Otherwise the value remains NULL. */
    1192     + if (unlikely (elf->state.elf64.ehdr->e_phoff >= maxsize)
    1193     + || unlikely (elf->state.elf64.ehdr->e_phoff
    1194     + + elf->state.elf64.ehdr->e_phnum
    1195     + * sizeof (Elf64_Phdr) > maxsize))
    1196     + goto free_and_out;
    1197     + elf->state.elf64.phdr
    1198     + = (Elf64_Phdr *) ((char *) map_address + offset
    1199     + + elf->state.elf64.ehdr->e_phoff);
    1200     + }
    1201    
    1202     for (size_t cnt = 0; cnt < scncnt; ++cnt)
    1203     {
    1204     @@ -370,8 +411,7 @@ file_read_elf (int fildes, void *map_add
    1205     sizeof (Elf64_Ehdr), offset) != sizeof (Elf64_Ehdr))
    1206     {
    1207     /* We must be able to read the ELF header. */
    1208     - __libelf_seterrno (ELF_E_INVALID_FILE);
    1209     - return NULL;
    1210     + goto free_and_out;
    1211     }
    1212    
    1213     if (e_ident[EI_DATA] != MY_ELFDATA)
    1214     --- elfutils-0.108/src/elflint.c.jj 2005-05-14 02:22:24.000000000 +0200
    1215     +++ elfutils-0.108/src/elflint.c 2005-05-17 18:02:00.000000000 +0200
    1216     @@ -309,6 +309,8 @@ section_name (Ebl *ebl, int idx)
    1217     return "<invalid>";
    1218    
    1219     shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
    1220     + if (shdr == NULL)
    1221     + return "<invalid>";
    1222    
    1223     ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    1224     if (ret == NULL)
    1225     @@ -1639,19 +1641,26 @@ section [%2d] '%s': hash table section i
    1226     {
    1227     size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
    1228     size_t cnt;
    1229     + Elf32_Word *buf, *end;
    1230    
    1231     if (nchain < symshdr->sh_size / symshdr->sh_entsize)
    1232     ERROR (gettext ("section [%2d] '%s': chain array not large enough\n"),
    1233     idx, section_name (ebl, idx));
    1234    
    1235     + buf = ((Elf32_Word *) data->d_buf) + 2;
    1236     + end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
    1237     for (cnt = 2; cnt < 2 + nbucket; ++cnt)
    1238     - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
    1239     + if (buf >= end)
    1240     + return;
    1241     + else if (*buf++ >= symsize)
    1242     ERROR (gettext ("\
    1243     section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
    1244     idx, section_name (ebl, idx), cnt - 2);
    1245    
    1246     for (; cnt < 2 + nbucket + nchain; ++cnt)
    1247     - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
    1248     + if (buf >= end)
    1249     + return;
    1250     + else if (*buf++ >= symsize)
    1251     ERROR (gettext ("\
    1252     section [%2d] '%s': hash chain reference %zu out of bounds\n"),
    1253     idx, section_name (ebl, idx), cnt - 2 - nbucket);
    1254     @@ -2311,6 +2320,8 @@ phdr[%d]: no note entries defined for th
    1255     return;
    1256    
    1257     char *notemem = gelf_rawchunk (ebl->elf, phdr->p_offset, phdr->p_filesz);
    1258     + if (notemem == NULL)
    1259     + return;
    1260    
    1261     /* ELF64 files often use note section entries in the 32-bit format.
    1262     The p_align field is set to 8 in case the 64-bit format is used.
    1263    
    1264     --- elfutils/src/strip.c
    1265     +++ elfutils/src/strip.c
    1266     @@ -400,6 +400,7 @@ handle_elf (int fd, Elf *elf, const char
    1267     Elf_Data debuglink_crc_data;
    1268     bool any_symtab_changes = false;
    1269     Elf_Data *shstrtab_data = NULL;
    1270     + size_t shdridx = 0;
    1271    
    1272     /* Create the full name of the file. */
    1273     if (prefix != NULL)
    1274     @@ -531,6 +532,11 @@ handle_elf (int fd, Elf *elf, const char
    1275     goto fail_close;
    1276     }
    1277    
    1278     + if (shstrndx >= shnum)
    1279     + goto illformed;
    1280     +
    1281     +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
    1282     +
    1283     /* Storage for section information. We leave room for two more
    1284     entries since we unconditionally create a section header string
    1285     table. Maybe some weird tool created an ELF file without one.
    1286     @@ -552,7 +558,7 @@ handle_elf (int fd, Elf *elf, const char
    1287     {
    1288     /* This should always be true (i.e., there should not be any
    1289     holes in the numbering). */
    1290     - assert (elf_ndxscn (scn) == cnt);
    1291     + elf_assert (elf_ndxscn (scn) == cnt);
    1292    
    1293     shdr_info[cnt].scn = scn;
    1294    
    1295     @@ -565,6 +571,7 @@ handle_elf (int fd, Elf *elf, const char
    1296     shdr_info[cnt].shdr.sh_name);
    1297     if (shdr_info[cnt].name == NULL)
    1298     {
    1299     + illformed:
    1300     error (0, 0, gettext ("illformed file '%s'"), fname);
    1301     goto fail_close;
    1302     }
    1303     @@ -574,6 +581,8 @@ handle_elf (int fd, Elf *elf, const char
    1304    
    1305     /* Remember the shdr.sh_link value. */
    1306     shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
    1307     + if (shdr_info[cnt].old_sh_link >= shnum)
    1308     + goto illformed;
    1309    
    1310     /* Sections in files other than relocatable object files which
    1311     are not loaded can be freely moved by us. In relocatable
    1312     @@ -586,7 +595,7 @@ handle_elf (int fd, Elf *elf, const char
    1313     appropriate reference. */
    1314     if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
    1315     {
    1316     - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    1317     + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    1318     shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
    1319     }
    1320     else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
    1321     @@ -605,7 +614,12 @@ handle_elf (int fd, Elf *elf, const char
    1322     for (inner = 1;
    1323     inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
    1324     ++inner)
    1325     - shdr_info[grpref[inner]].group_idx = cnt;
    1326     + {
    1327     + if (grpref[inner] < shnum)
    1328     + shdr_info[grpref[inner]].group_idx = cnt;
    1329     + else
    1330     + goto illformed;
    1331     + }
    1332    
    1333     if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
    1334     /* If the section group contains only one element and this
    1335     @@ -616,7 +630,7 @@ handle_elf (int fd, Elf *elf, const char
    1336     }
    1337     else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
    1338     {
    1339     - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    1340     + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    1341     shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
    1342     }
    1343    
    1344     @@ -624,7 +638,7 @@ handle_elf (int fd, Elf *elf, const char
    1345     discarded right away. */
    1346     if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
    1347     {
    1348     - assert (shdr_info[cnt].group_idx != 0);
    1349     + elf_assert (shdr_info[cnt].group_idx != 0);
    1350    
    1351     if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
    1352     {
    1353     @@ -700,10 +714,14 @@ handle_elf (int fd, Elf *elf, const char
    1354     {
    1355     /* If a relocation section is marked as being removed make
    1356     sure the section it is relocating is removed, too. */
    1357     - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
    1358     - || shdr_info[cnt].shdr.sh_type == SHT_RELA)
    1359     - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    1360     - shdr_info[cnt].idx = 1;
    1361     + if (shdr_info[cnt].shdr.sh_type == SHT_REL
    1362     + || shdr_info[cnt].shdr.sh_type == SHT_RELA)
    1363     + {
    1364     + if (shdr_info[cnt].shdr.sh_info >= shnum)
    1365     + goto illformed;
    1366     + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    1367     + shdr_info[cnt].idx = 1;
    1368     + }
    1369     }
    1370    
    1371     if (shdr_info[cnt].idx == 1)
    1372     @@ -733,7 +751,7 @@ handle_elf (int fd, Elf *elf, const char
    1373     if (shdr_info[cnt].symtab_idx != 0
    1374     && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
    1375     {
    1376     - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    1377     + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    1378    
    1379     shdr_info[shdr_info[cnt].symtab_idx].data
    1380     = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    1381     @@ -773,6 +791,9 @@ handle_elf (int fd, Elf *elf, const char
    1382     else if (scnidx == SHN_XINDEX)
    1383     scnidx = xndx;
    1384    
    1385     + if (scnidx >= shnum)
    1386     + goto illformed;
    1387     +
    1388     if (shdr_info[scnidx].idx == 0)
    1389     {
    1390     /* Mark this section as used. */
    1391     @@ -804,11 +825,15 @@ handle_elf (int fd, Elf *elf, const char
    1392     }
    1393    
    1394     /* Handle references through sh_info. */
    1395     - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
    1396     - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    1397     + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
    1398     {
    1399     - shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
    1400     - changes |= shdr_info[cnt].shdr.sh_info < cnt;
    1401     + if (shdr_info[cnt].shdr.sh_info >= shnum)
    1402     + goto illformed;
    1403     + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    1404     + {
    1405     + shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
    1406     + changes |= shdr_info[cnt].shdr.sh_info < cnt;
    1407     + }
    1408     }
    1409    
    1410     /* Mark the section as investigated. */
    1411     @@ -911,7 +936,7 @@ handle_elf (int fd, Elf *elf, const char
    1412     error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
    1413     elf_errmsg (-1));
    1414    
    1415     - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1416     + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1417    
    1418     /* Add this name to the section header string table. */
    1419     shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
    1420     @@ -951,7 +976,7 @@ handle_elf (int fd, Elf *elf, const char
    1421     error (EXIT_FAILURE, 0,
    1422     gettext ("while create section header section: %s"),
    1423     elf_errmsg (-1));
    1424     - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1425     + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1426    
    1427     shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
    1428     if (shdr_info[cnt].data == NULL)
    1429     @@ -982,7 +1007,7 @@ handle_elf (int fd, Elf *elf, const char
    1430     }
    1431    
    1432     /* Index of the section header table in the shdr_info array. */
    1433     - size_t shdridx = cnt;
    1434     + shdridx = cnt;
    1435    
    1436     /* Add the section header string table section name. */
    1437     shdr_info[cnt].se = ebl_strtabadd (shst, ".shstrtab", 10);
    1438     @@ -1007,7 +1032,7 @@ handle_elf (int fd, Elf *elf, const char
    1439     error (EXIT_FAILURE, 0,
    1440     gettext ("while create section header section: %s"),
    1441     elf_errmsg (-1));
    1442     - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    1443     + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    1444    
    1445     /* Finalize the string table and fill in the correct indices in the
    1446     section headers. */
    1447     @@ -1097,21 +1122,21 @@ handle_elf (int fd, Elf *elf, const char
    1448     shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    1449     NULL);
    1450    
    1451     - assert ((versiondata->d_size / sizeof (Elf32_Word))
    1452     - >= shdr_info[cnt].data->d_size / elsize);
    1453     + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
    1454     + >= shdr_info[cnt].data->d_size / elsize);
    1455     }
    1456    
    1457     if (shdr_info[cnt].version_idx != 0)
    1458     {
    1459     - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    1460     + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    1461     /* This section has associated version
    1462     information. We have to modify that
    1463     information, too. */
    1464     versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
    1465     NULL);
    1466    
    1467     - assert ((versiondata->d_size / sizeof (GElf_Versym))
    1468     - >= shdr_info[cnt].data->d_size / elsize);
    1469     + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
    1470     + >= shdr_info[cnt].data->d_size / elsize);
    1471     }
    1472    
    1473     shdr_info[cnt].newsymidx
    1474     @@ -1165,7 +1190,7 @@ handle_elf (int fd, Elf *elf, const char
    1475     sec = shdr_info[sym->st_shndx].idx;
    1476     else
    1477     {
    1478     - assert (shndxdata != NULL);
    1479     + elf_assert (shndxdata != NULL);
    1480    
    1481     sec = shdr_info[xshndx].idx;
    1482     }
    1483     @@ -1186,7 +1211,7 @@ handle_elf (int fd, Elf *elf, const char
    1484     nxshndx = sec;
    1485     }
    1486    
    1487     - assert (sec < SHN_LORESERVE || shndxdata != NULL);
    1488     + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
    1489    
    1490     if ((inner != destidx || nshndx != sym->st_shndx
    1491     || (shndxdata != NULL && nxshndx != xshndx))
    1492     @@ -1209,7 +1234,7 @@ handle_elf (int fd, Elf *elf, const char
    1493     else
    1494     /* This is a section symbol for a section which has
    1495     been removed. */
    1496     - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    1497     + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    1498     }
    1499    
    1500     if (destidx != inner)
    1501     @@ -1373,11 +1398,11 @@ handle_elf (int fd, Elf *elf, const char
    1502     {
    1503     GElf_Sym sym_mem;
    1504     GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    1505     - assert (sym != NULL);
    1506     + elf_assert (sym != NULL);
    1507    
    1508     const char *name = elf_strptr (elf, strshndx,
    1509     sym->st_name);
    1510     - assert (name != NULL);
    1511     + elf_assert (name != NULL);
    1512     size_t hidx = elf_hash (name) % nbucket;
    1513    
    1514     if (bucket[hidx] == 0)
    1515     @@ -1396,8 +1421,8 @@ handle_elf (int fd, Elf *elf, const char
    1516     else
    1517     {
    1518     /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
    1519     - assert (shdr_info[cnt].shdr.sh_entsize
    1520     - == sizeof (Elf64_Xword));
    1521     + elf_assert (shdr_info[cnt].shdr.sh_entsize
    1522     + == sizeof (Elf64_Xword));
    1523    
    1524     Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
    1525    
    1526     @@ -1430,11 +1455,11 @@ handle_elf (int fd, Elf *elf, const char
    1527     {
    1528     GElf_Sym sym_mem;
    1529     GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    1530     - assert (sym != NULL);
    1531     + elf_assert (sym != NULL);
    1532    
    1533     const char *name = elf_strptr (elf, strshndx,
    1534     sym->st_name);
    1535     - assert (name != NULL);
    1536     + elf_assert (name != NULL);
    1537     size_t hidx = elf_hash (name) % nbucket;
    1538    
    1539     if (bucket[hidx] == 0)
    1540     --- elfutils/src/readelf.c
    1541     +++ elfutils/src/readelf.c
    1542     @@ -947,6 +947,7 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1543     GElf_Shdr *symshdr;
    1544     Elf_Data *symdata;
    1545     GElf_Sym sym_mem;
    1546     + GElf_Sym *sym;
    1547     size_t cnt;
    1548     size_t shstrndx;
    1549    
    1550     @@ -966,6 +967,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1551     error (EXIT_FAILURE, 0,
    1552     gettext ("cannot get section header string table index"));
    1553    
    1554     + sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
    1555     +
    1556     grpref = (Elf32_Word *) data->d_buf;
    1557    
    1558     printf ((grpref[0] & GRP_COMDAT)
    1559     @@ -980,8 +983,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1560     data->d_size / sizeof (Elf32_Word) - 1),
    1561     elf_ndxscn (scn),
    1562     elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
    1563     - elf_strptr (ebl->elf, symshdr->sh_link,
    1564     - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
    1565     + (sym == NULL ? NULL
    1566     + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
    1567     ?: gettext ("<INVALID SYMBOL>"),
    1568     data->d_size / sizeof (Elf32_Word) - 1);
    1569    
    1570     @@ -1135,7 +1138,8 @@ static void
    1571     handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
    1572     {
    1573     int class = gelf_getclass (ebl->elf);
    1574     - GElf_Shdr glink;
    1575     + GElf_Shdr glink_mem;
    1576     + GElf_Shdr *glink;
    1577     Elf_Data *data;
    1578     size_t cnt;
    1579     size_t shstrndx;
    1580     @@ -1150,6 +1154,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    1581     error (EXIT_FAILURE, 0,
    1582     gettext ("cannot get section header string table index"));
    1583    
    1584     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1585     + if (glink == NULL)
    1586     + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1587     + elf_ndxscn (scn));
    1588     +
    1589     printf (ngettext ("\
    1590     \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1591     "\
    1592     @@ -1159,9 +1168,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    1593     class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1594     shdr->sh_offset,
    1595     (int) shdr->sh_link,
    1596     - elf_strptr (ebl->elf, shstrndx,
    1597     - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1598     - &glink)->sh_name));
    1599     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1600     fputs_unlocked (gettext (" Type Value\n"), stdout);
    1601    
    1602     for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    1603     @@ -1656,7 +1663,8 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1604     unsigned int cnt;
    1605     Elf32_Word verneed_stridx = 0;
    1606     Elf32_Word verdef_stridx = 0;
    1607     - GElf_Shdr glink;
    1608     + GElf_Shdr glink_mem;
    1609     + GElf_Shdr *glink;
    1610     size_t shstrndx;
    1611    
    1612     /* Get the data of the section. */
    1613     @@ -1701,6 +1709,11 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1614     error (EXIT_FAILURE, 0,
    1615     gettext ("cannot get section header string table index"));
    1616    
    1617     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1618     + if (glink == NULL)
    1619     + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1620     + elf_ndxscn (scn));
    1621     +
    1622     /* Now we can compute the number of entries in the section. */
    1623     nsyms = data->d_size / (class == ELFCLASS32
    1624     ? sizeof (Elf32_Sym) : sizeof (Elf64_Sym));
    1625     @@ -1715,9 +1728,7 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1626     shdr->sh_info),
    1627     (unsigned long int) shdr->sh_info,
    1628     (unsigned int) shdr->sh_link,
    1629     - elf_strptr (ebl->elf, shstrndx,
    1630     - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1631     - &glink)->sh_name));
    1632     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1633    
    1634     fputs_unlocked (class == ELFCLASS32
    1635     ? gettext ("\
    1636     @@ -1945,7 +1956,8 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1637     {
    1638     Elf_Data *data;
    1639     int class = gelf_getclass (ebl->elf);
    1640     - GElf_Shdr glink;
    1641     + GElf_Shdr glink_mem;
    1642     + GElf_Shdr *glink;
    1643     int cnt;
    1644     unsigned int offset;
    1645     size_t shstrndx;
    1646     @@ -1960,6 +1972,11 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1647     error (EXIT_FAILURE, 0,
    1648     gettext ("cannot get section header string table index"));
    1649    
    1650     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1651     + if (glink == NULL)
    1652     + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1653     + elf_ndxscn (scn));
    1654     +
    1655     printf (ngettext ("\
    1656     \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1657     "\
    1658     @@ -1970,9 +1987,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1659     class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1660     shdr->sh_offset,
    1661     (unsigned int) shdr->sh_link,
    1662     - elf_strptr (ebl->elf, shstrndx,
    1663     - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1664     - &glink)->sh_name));
    1665     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1666    
    1667     offset = 0;
    1668     for (cnt = shdr->sh_info; --cnt >= 0; )
    1669     @@ -2022,7 +2037,8 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1670     {
    1671     Elf_Data *data;
    1672     int class = gelf_getclass (ebl->elf);
    1673     - GElf_Shdr glink;
    1674     + GElf_Shdr glink_mem;
    1675     + GElf_Shdr *glink;
    1676     int cnt;
    1677     unsigned int offset;
    1678     size_t shstrndx;
    1679     @@ -2037,6 +2053,11 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1680     error (EXIT_FAILURE, 0,
    1681     gettext ("cannot get section header string table index"));
    1682    
    1683     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1684     + if (glink == NULL)
    1685     + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1686     + elf_ndxscn (scn));
    1687     +
    1688     printf (ngettext ("\
    1689     \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1690     "\
    1691     @@ -2048,9 +2069,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1692     class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1693     shdr->sh_offset,
    1694     (unsigned int) shdr->sh_link,
    1695     - elf_strptr (ebl->elf, shstrndx,
    1696     - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1697     - &glink)->sh_name));
    1698     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1699    
    1700     offset = 0;
    1701     for (cnt = shdr->sh_info; --cnt >= 0; )
    1702     @@ -2106,7 +2125,8 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1703     Elf_Data *data;
    1704     int class = gelf_getclass (ebl->elf);
    1705     Elf_Scn *verscn;
    1706     - GElf_Shdr glink;
    1707     + GElf_Shdr glink_mem;
    1708     + GElf_Shdr *glink;
    1709     Elf_Scn *defscn;
    1710     Elf_Scn *needscn;
    1711     const char **vername;
    1712     @@ -2125,6 +2145,11 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1713     error (EXIT_FAILURE, 0,
    1714     gettext ("cannot get section header string table index"));
    1715    
    1716     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1717     + if (glink == NULL)
    1718     + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1719     + elf_ndxscn (scn));
    1720     +
    1721     /* We have to find the version definition section and extract the
    1722     version names. */
    1723     defscn = NULL;
    1724     @@ -2347,9 +2372,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1725     class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1726     shdr->sh_offset,
    1727     (unsigned int) shdr->sh_link,
    1728     - elf_strptr (ebl->elf, shstrndx,
    1729     - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1730     - &glink)->sh_name));
    1731     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1732    
    1733     /* Now we can finally look at the actual contents of this section. */
    1734     for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    1735     @@ -2425,7 +2448,8 @@ handle_hash (Ebl *ebl)
    1736     Elf32_Word maxlength = 0;
    1737     Elf32_Word nsyms = 0;
    1738     uint64_t nzero_counts = 0;
    1739     - GElf_Shdr glink;
    1740     + GElf_Shdr glink_mem;
    1741     + GElf_Shdr *glink;
    1742    
    1743     if (data == NULL)
    1744     {
    1745     @@ -2434,6 +2458,16 @@ handle_hash (Ebl *ebl)
    1746     continue;
    1747     }
    1748    
    1749     +
    1750     + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1751     + &glink_mem);
    1752     + if (glink == NULL)
    1753     + {
    1754     + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
    1755     + elf_ndxscn (scn));
    1756     + continue;
    1757     + }
    1758     +
    1759     nbucket = ((Elf32_Word *) data->d_buf)[0];
    1760     nchain = ((Elf32_Word *) data->d_buf)[1];
    1761     bucket = &((Elf32_Word *) data->d_buf)[2];
    1762     @@ -2451,10 +2485,7 @@ handle_hash (Ebl *ebl)
    1763     shdr->sh_addr,
    1764     shdr->sh_offset,
    1765     (unsigned int) shdr->sh_link,
    1766     - elf_strptr (ebl->elf, shstrndx,
    1767     - gelf_getshdr (elf_getscn (ebl->elf,
    1768     - shdr->sh_link),
    1769     - &glink)->sh_name));
    1770     + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1771    
    1772     lengths = (uint32_t *) xcalloc (nbucket, sizeof (uint32_t));
    1773