asan: readelf: wild read in get_num_dynamic_syms

Message ID 20200521005137.GA16548@bubble.grove.modra.org
State New
Headers show
Series
  • asan: readelf: wild read in get_num_dynamic_syms
Related show

Commit Message

* readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
	access.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 87bb574129..798782c3a8 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -10211,7 +10211,8 @@  get_num_dynamic_syms (Filedata * filedata)
 	      {
 		if (filedata->dynamic_info_DT_MIPS_XHASH)
 		  {
-		    if (filedata->mipsxlat[off] >= num_of_syms)
+		    if (off < filedata->ngnuchains
+			&& filedata->mipsxlat[off] >= num_of_syms)
 		      num_of_syms = filedata->mipsxlat[off] + 1;
 		  }
 		else