readelf: Fix incorrect "Version definition past end of section" message

Fix a commit 74e1a04b9787 ("More fixes for reading corrupt ELF files.")
`readelf --version-info' regression that caused "Version definition past
end of section" to be always printed at the end, even with good section
data.

For example with the `mips-linux' target we get:

$ cat ver_def.s
	.data
	.globl	new_foo
	.type	new_foo, %object
new_foo:
	.symver	new_foo, foo@@ver_foo
$ cat ver_def.ver
{ global: *foo*; local: *; };
$ as -o ver_def.o ver_def.s
$ ld -e 0 --export-dynamic --version-script=ver_def.ver -o ver_def ver_def.o
$ readelf -V ver_def

Version symbols section '.gnu.version' contains 4 entries:
 Addr: 000000000000007e  Offset: 0x01007e  Link: 2 (.dynsym)
  000:   0 (*local*)       2 (ver_foo)       1 (*global*)      2 (ver_foo)

Version definition section '.gnu.version_d' contains 2 entries:
  Addr: 0x0000000000000088  Offset: 0x010088  Link: 3 (.dynstr)
  000000: Rev: 1  Flags: BASE   Index: 1  Cnt: 1  Name: ver_def
  0x001c: Rev: 1  Flags: none  Index: 2  Cnt: 1  Name: ver_foo
  Version definition past end of section
$

The cause is the `if (idx + ent.vd_next <= idx)' condition introduced to
ensure forward progress, which however always triggers for good version
definition section data as the last entry will have its `vd_next' value
set to 0.

Adjust the condition then, to say `if (idx + ent.vd_next < idx)' instead
and to ensure forward progress limit the number of entries processed to
the size of the version definition section, removing the problematic
message from output quoted above, while ensuring the original PR 17531
test case is still handled gracefully.

Add a suitable test case so that we have `readelf --version-info'
coverage; due to the lack of infrastructure needed to run the linker in
the `binutils' test suite and limited justification to implement it add
a new `readelf.exp' script to the `ld' test suite instead, intended to
gather any `readelf' test cases that require the linker to be run.  If
ever we decide to have linker infrastructure added to the `binutils'
test suite, then the script can be moved between the test suites.

	binutils/
	* readelf.c (process_version_sections) <SHT_GNU_verdef>: Limit
	the number of entries processed by the section size.  Don't
	break out of the loop if `ent.vd_next' is 0.

	ld/
	* testsuite/ld-elf/ver_def.d: New test.
	* testsuite/ld-elf/ver_def.ld: New test linker script.
	* testsuite/ld-elf/ver_def.ver: New test version script.
	* testsuite/ld-elf/ver_def.s: New test source.
	* testsuite/ld-elf/readelf.exp: New test script.

2 files changed, 14 insertions, 3 deletions

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index a21e36e..a528db4 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2017-02-24  Maciej W. Rozycki  <macro@imgtec.com>
+
+	* readelf.c (process_version_sections) <SHT_GNU_verdef>: Limit
+	the number of entries processed by the section size.  Don't
+	break out of the loop if `ent.vd_next' is 0.
+
 2017-02-23  Jan Kratochvil  <jan.kratochvil@redhat.com>
 
 	* testsuite/binutils-all/dw5.S: New file.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 9caa4da..cb0da10 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -9994,6 +9994,7 @@ process_version_sections (FILE * file)
 	    Elf_External_Verdef * edefs;
 	    unsigned int idx;
 	    unsigned int cnt;
+	    unsigned int end;
 	    char * endbuf;
 
 	    found = 1;
@@ -10015,7 +10016,10 @@ process_version_sections (FILE * file)
 	      break;
 	    endbuf = (char *) edefs + section->sh_size;
 
-	    for (idx = cnt = 0; cnt < section->sh_info; ++cnt)
+	    /* PR 17531: file: id:000001,src:000172+005151,op:splice,rep:2.  */
+	    end = (section->sh_info < section->sh_size
+		   ? section->sh_info : section->sh_size);
+	    for (idx = cnt = 0; cnt < end; ++cnt)
 	      {
 		char * vstart;
 		Elf_External_Verdef * edef;
@@ -10094,8 +10098,9 @@ process_version_sections (FILE * file)
 		if (j < ent.vd_cnt)
 		  printf (_("  Version def aux past end of section\n"));
 
-		/* PR 17531: file: id:000001,src:000172+005151,op:splice,rep:2.  */
-		if (idx + ent.vd_next <= idx)
+		/* PR 17531:
+		   file: id:000001,src:000172+005151,op:splice,rep:2.  */
+		if (idx + ent.vd_next < idx)
 		  break;
 
 		idx += ent.vd_next;