serge1/ELFIO

generic_get_symbol can access past end of symbol section if entry_size in is smaller than sizeof(Elf64_Sym) or sizeof(Elf32_Sym)

Alan-Jowett opened this issue · 0 comments

crash-5ed2f6c25a8e8828689e28c5021b1da46f277d4e.zip

In this case, entry_size for the symbol section is 1, which causes generic_get_symbol get_symbols_num to return symbol count == size of section.

When accessing the last element, generic_get_symbol reads past the end of the symbol section.

@Alan-Jowett to provide PR.