From: Mark Wielaard Date: Fri, 3 Jul 2026 14:01:32 +0000 (+0200) Subject: libelf: Correct the size of the in memory datastructure (off-by-one) X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=60cb1486c6fbaef2ab6a9db9007a23f5c7dcefda;p=thirdparty%2Felfutils.git libelf: Correct the size of the in memory datastructure (off-by-one) Fix the u64 and u32 variable length array bounds. We state they are [n], but there is actually room for [n+1] symbols. We don't actually use the [n+1] entry, but we the undefined sanitizer warns about this. Found by a new testcase by Kane Wang * libelf/elf_getarsym.c (elf_getarsym): Mark (*u64) and (*u32) as [n+1] arrays. Signed-off-by: Mark Wielaard --- diff --git a/libelf/elf_getarsym.c b/libelf/elf_getarsym.c index ec05c684..03381059 100644 --- a/libelf/elf_getarsym.c +++ b/libelf/elf_getarsym.c @@ -261,8 +261,8 @@ elf_getarsym (Elf *elf, size_t *ptr) /* Now we can build the data structure. */ Elf_Arsym *arsym = elf->state.ar.ar_sym; - uint64_t (*u64)[n] = file_data; - uint32_t (*u32)[n] = file_data; + uint64_t (*u64)[n+1] = file_data; + uint32_t (*u32)[n+1] = file_data; for (size_t cnt = 0; cnt < n; ++cnt) { arsym[cnt].as_name = str_data;