asan: readelf: wild read in get_num_dynamic_syms

	* readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
	access.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 2b903512bf56381e0560ba5c1444757e278d50df..e906bdf75c47f277ef482438b42d2a92f27377c4 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2020-05-21  Alan Modra  <amodra@gmail.com>
+
+       * readelf.c (get_num_dynamic_syms): Bounds check mipsxlat array
+       access.
+
 2020-05-20  Nelson Chu  <nelson.chu@sifive.com>
 
        * dwarf.c: Updated since DECLARE_CSR is changed.

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 87bb574129fb5b67f2ddc1dde9f6fe45ed7da381..798782c3a8209c467a90c1d0fb4ab82d93865e49 100644 (file)
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -10211,7 +10211,8 @@ get_num_dynamic_syms (Filedata * filedata)
              {
                if (filedata->dynamic_info_DT_MIPS_XHASH)
                  {
-                   if (filedata->mipsxlat[off] >= num_of_syms)
+                   if (off < filedata->ngnuchains
+                       && filedata->mipsxlat[off] >= num_of_syms)
                      num_of_syms = filedata->mipsxlat[off] + 1;
                  }
                else