diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp index 343a97e5..f347e847 100644 --- a/src/p_lx_elf.cpp +++ b/src/p_lx_elf.cpp @@ -1683,7 +1683,7 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp, unsigned dt_filesz) unsigned const *const chains = &buckets[nbucket]; (void)chains; unsigned const v_sym = !x_sym ? 0 : get_te32(&dynp0[-1+ x_sym].d_val); - if (!nbucket || (nbucket>>31) || !v_sym || file_size <= v_sym + if (!nbucket || (nbucket>>31) || !v_sym || (unsigned)file_size <= v_sym || ((v_hsh < v_sym) && (v_sym - v_hsh) < sizeof(*buckets)*(2+ nbucket)) ) { char msg[80]; snprintf(msg, sizeof(msg), @@ -5298,7 +5298,7 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp, upx_uint64_t dt_filesz) unsigned const *const chains = &buckets[nbucket]; (void)chains; unsigned const v_sym = !x_sym ? 0 : get_te32(&dynp0[-1+ x_sym].d_val); - if (!nbucket || (nbucket>>31) || !v_sym || file_size <= v_sym + if (!nbucket || (nbucket>>31) || !v_sym || (unsigned)file_size <= v_sym || ((v_hsh < v_sym) && (v_sym - v_hsh) < sizeof(*buckets)*(2+ nbucket)) ) { char msg[80]; snprintf(msg, sizeof(msg),