aboutsummaryrefslogtreecommitdiff
path: root/binutils/readelf.c
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2015-07-17 00:13:22 +0930
committerAlan Modra <amodra@gmail.com>2015-07-17 00:27:10 +0930
commit53c3012ccc25ecfc4fa1f52e341e19b30d1e57db (patch)
treef5a74a8e116a664c99769fbf143f1e3fa8db1984 /binutils/readelf.c
parent77a69ff840d60cca73624e16e5b2dd5217a6037e (diff)
downloadgdb-53c3012ccc25ecfc4fa1f52e341e19b30d1e57db.zip
gdb-53c3012ccc25ecfc4fa1f52e341e19b30d1e57db.tar.gz
gdb-53c3012ccc25ecfc4fa1f52e341e19b30d1e57db.tar.bz2
Correct readelf dynamic section buffer overlow test
PR binutils/18672 * readelf.c (get_32bit_dynamic_section): Correct buffer limit test. (get_64bit_dynamic_section): Likewise.
Diffstat (limited to 'binutils/readelf.c')
-rw-r--r--binutils/readelf.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 55faf83..c313db4 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -8683,7 +8683,7 @@ get_32bit_dynamic_section (FILE * file)
might not have the luxury of section headers. Look for the DT_NULL
terminator to determine the number of entries. */
for (ext = edyn, dynamic_nent = 0;
- (char *) ext < (char *) edyn + dynamic_size - sizeof (* entry);
+ (char *) (ext + 1) <= (char *) edyn + dynamic_size;
ext++)
{
dynamic_nent++;
@@ -8731,8 +8731,8 @@ get_64bit_dynamic_section (FILE * file)
might not have the luxury of section headers. Look for the DT_NULL
terminator to determine the number of entries. */
for (ext = edyn, dynamic_nent = 0;
- /* PR 17533 file: 033-67080-0.004 - do not read off the end of the buffer. */
- (char *) ext < ((char *) edyn) + dynamic_size - sizeof (* ext);
+ /* PR 17533 file: 033-67080-0.004 - do not read past end of buffer. */
+ (char *) (ext + 1) <= (char *) edyn + dynamic_size;
ext++)
{
dynamic_nent++;