[binutils-gdb] Correct readelf dynamic section buffer overlow test

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=53c3012ccc25ecfc4fa1f52e341e19b30d1e57db

commit 53c3012ccc25ecfc4fa1f52e341e19b30d1e57db
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Jul 17 00:13:22 2015 +0930

    Correct readelf dynamic section buffer overlow test
    
    	PR binutils/18672
    	* readelf.c (get_32bit_dynamic_section): Correct buffer limit test.
    	(get_64bit_dynamic_section): Likewise.

Diff:
---
 binutils/ChangeLog | 6 ++++++
 binutils/readelf.c | 6 +++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 4431ab8..a68a8ea 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,9 @@
+2015-07-16  Alan Modra  <amodra@gmail.com>
+
+	PR binutils/18672
+	* readelf.c (get_32bit_dynamic_section): Correct buffer limit test.
+	(get_64bit_dynamic_section): Likewise.
+
 2015-07-14  H.J. Lu  <hongjiu.lu@intel.com>
 
 	* objcopy.c (copy_file): Set BFD_COMPRESS_GABI if not
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 55faf83..c313db4 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -8683,7 +8683,7 @@ get_32bit_dynamic_section (FILE * file)
      might not have the luxury of section headers.  Look for the DT_NULL
      terminator to determine the number of entries.  */
   for (ext = edyn, dynamic_nent = 0;
-       (char *) ext < (char *) edyn + dynamic_size - sizeof (* entry);
+       (char *) (ext + 1) <= (char *) edyn + dynamic_size;
        ext++)
     {
       dynamic_nent++;
@@ -8731,8 +8731,8 @@ get_64bit_dynamic_section (FILE * file)
      might not have the luxury of section headers.  Look for the DT_NULL
      terminator to determine the number of entries.  */
   for (ext = edyn, dynamic_nent = 0;
-       /* PR 17533 file: 033-67080-0.004 - do not read off the end of the buffer.  */
-       (char *) ext < ((char *) edyn) + dynamic_size - sizeof (* ext);
+       /* PR 17533 file: 033-67080-0.004 - do not read past end of buffer.  */
+       (char *) (ext + 1) <= (char *) edyn + dynamic_size;
        ext++)
     {
       dynamic_nent++;