generic_get_symbol can access past end of symbol section if entry_size in is smaller than sizeof(Elf64_Sym) or sizeof(Elf32_Sym)
Alan-Jowett opened this issue · 0 comments
Alan-Jowett commented
crash-5ed2f6c25a8e8828689e28c5021b1da46f277d4e.zip
In this case, entry_size for the symbol section is 1, which causes generic_get_symbol get_symbols_num to return symbol count == size of section.
When accessing the last element, generic_get_symbol reads past the end of the symbol section.
@Alan-Jowett to provide PR.