[llvm-readobj] - Fix crashes and misbehaviors when reading strings from broken string tables.

[grimar]

Summary

There are cases when we either might print garbage or crash when
reading strings for dumping dynamic tags.

For example when a string table is not null-terminated or goes past the EOF.
This patch fixes issues mentioned.

[jhenderson]

Hmmm... my first instinct here is that we should print a single warning out-of-line, and then use the "<?>" pattern in place of the invalid strings. That probably goes for the existing messages too. What do you think about that idea?

[grimar]

In D77216#1954873, @jhenderson wrote:

Hmmm... my first instinct here is that we should print a single warning out-of-line, and then use the "<?>" pattern in place of the invalid strings. That probably goes for the existing messages too. What do you think about that idea?

Yeah, I've though about that we might want to change the code to this behavior as it would be more consistent with all kinds of other errors we have.
I'll prepare a patch to change the existent behavior first then.

[grimar]

• Updated after recent changes done by D77399.

[MaskRay]

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

336

Not terminated by a NUL.

or

Not null terminated

364

This can be omitted

[grimar]

• Addressed review comments.

[MaskRay]

Thanks! Please wait a bit for @jhenderson's opinions (I think today is a public holiday (Easter Monday))

[jhenderson]

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

289

--implicit-check-not=warning: is probably better to avoid weird failures with path names involving "warning" (there's bound to be somebody out there...).

Same below.

293

I might be inclined to move these checks to below all the RUN lines for the different cases, as the use of NOT-TERMINATED-LESS is a little confusing when nothing up to that point in the test file had actually speciifed it.

384

strings are dumped because the file ends with the zero byte

What guarantees this? Should we add something to either a) validate it (to make it easier to identify the problem if it doesn't end with a zero byte) or b) force it to always be zero?

385

Delete one of the "as a".

llvm/tools/llvm-readobj/ELFDumper.cpp

2576–2578

I think you can make the message slightly more concise:

"string table at offset 0x12345678 with size 0x87654321 goes past the end of the file (0x22222222)"

2585

Unrelated I know, but this should be ':' not ',' for more correct grammar.

2592

I'd change ',' to ':' here.

[grimar]

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

384

But should we care/do something more? The intention of this test is to document the behavior when "the value of DT_STRSZ tag is set so that the string table ends right before the EOF". In this case dumping of strings is a side effect, so I've put a "Note". If the file had no zero byte at the end, we would dump "<?>", but what we really want to check is that we do not crash here and in the "Case B" below.

[grimar]

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

375

I guess this is misleading. What about I change this to:

"Document the behaviort when the dynamic string table ends past the end of the file. Check we do not crash."

[grimar]

• Addressed review comments.

llvm/tools/llvm-readobj/ELFDumper.cpp

2585

Fixed (to be consistent with new messages around).

[jhenderson]

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

375

Maybe this could be "Check that we emit an appropriate warning when the dynamic string table ends past the end of the file."

377

Add "No warning should be emitted." here, I think.

384–385

I think if we rewrite this note slightly, we could clarify more that it's not important what the final byte is:

"Note: The code reads the data in [DT_STRTAB, DT_STRTAB + DT_STRSZ] as the string table as normal. Since the file ends with a zero byte, strings are dumped, but if it didn't, we'd get <?> printed instead. The important bit is that we don't get the past the end warning."

[grimar]

• Addressed review comments.

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

384–385

Reads better, thanks.

[jhenderson]

LGTM.

llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test

 ## Test handling of a dynamic section size which is not a multiple of its entry size.
 ## Test the full output to demonstrate how we print the warnings.
 
 # RUN: yaml2obj %s --docnum=1 -o %t.bad-size
 # RUN: llvm-readobj --all %t.bad-size 2>&1 \
-# RUN:   | FileCheck %s -DFILE=%t.bad-size --implicit-check-not=warning --check-prefix WARN
+# RUN:   | FileCheck %s -DFILE=%t.bad-size --implicit-check-not=warning: --check-prefix WARN
 # RUN: llvm-readelf --all %t.bad-size 2>&1 \
-# RUN:   | FileCheck %s -DFILE=%t.bad-size --implicit-check-not=warning --check-prefix WARN-GNU
+# RUN:   | FileCheck %s -DFILE=%t.bad-size --implicit-check-not=warning: --check-prefix WARN-GNU
 
 # WARN: warning: '[[FILE]]': invalid PT_DYNAMIC size (0x4){{$}}
 # WARN: warning: '[[FILE]]': section with index 1 has invalid size (0x4){{$}}
 # WARN: warning: '[[FILE]]': no valid dynamic table was found
 # WARN-EMPTY:
 # WARN: File:
 # WARN: ProgramHeaders [
 # WARN: Symbols [

 
 ## Test handling of string references pointing past the end of the dynamic string table.
 # RUN: yaml2obj %s --docnum=3 -o %t.bad-string
 # RUN: llvm-readobj --dynamic-table %t.bad-string 2>&1 | \
 # RUN:   FileCheck %s --implicit-check-not=warning: --check-prefix BAD-STRING-LLVM -DFILE=%t.bad-string
 # RUN: llvm-readelf --dynamic-table %t.bad-string 2>&1 | \
 # RUN:   FileCheck %s --implicit-check-not=warning: --check-prefix BAD-STRING-GNU -DFILE=%t.bad-string
 
-# BAD-STRING-LLVM:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM:      LoadName: <?>
 # BAD-STRING-LLVM:      DynamicSection [ (10 entries)
 # BAD-STRING-LLVM-NEXT:   Tag                Type      Name/Value
 # BAD-STRING-LLVM-NEXT:   0x0000000000000005 STRTAB    0x1000
 # BAD-STRING-LLVM-NEXT:   0x000000000000000A STRSZ     1 (bytes)
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb2, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb2: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x0000000000000001 NEEDED    Shared library: [<?>]
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb3, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb3: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x000000007FFFFFFF FILTER    Filter library: [<?>]
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb4, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb4: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x000000007FFFFFFD AUXILIARY Auxiliary library: [<?>]
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb5, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb5: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x000000007FFFFFFE USED      Not needed object: [<?>]
 ## Note: there is no "string table at offset 0xb0..." warning here, because it was printed earlier.
 # BAD-STRING-LLVM-NEXT:   0x000000000000000E SONAME    Library soname: [<?>]
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb7, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb7: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x000000000000000F RPATH     Library rpath: [<?>]
-# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb8, it goes past the end of the table (0xb1)
+# BAD-STRING-LLVM-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb8: it goes past the end of the table (0xb1)
 # BAD-STRING-LLVM-NEXT:   0x000000000000001D RUNPATH   Library runpath: [<?>]
 # BAD-STRING-LLVM-NEXT:   0x0000000000000000 NULL      0x0
 # BAD-STRING-LLVM-NEXT: ]
 
-# BAD-STRING-GNU:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT: Dynamic section at offset 0xb1 contains 10 entries:
 # BAD-STRING-GNU-NEXT:   Tag                Type        Name/Value
 # BAD-STRING-GNU-NEXT:   0x0000000000000005 (STRTAB)    0x1000
 # BAD-STRING-GNU-NEXT:   0x000000000000000a (STRSZ)     1 (bytes)
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb2, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb2: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x0000000000000001 (NEEDED)    Shared library: [<?>]
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb3, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb3: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x000000007fffffff (FILTER)    Filter library: [<?>]
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb4, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb4: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x000000007ffffffd (AUXILIARY) Auxiliary library: [<?>]
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb5, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb5: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x000000007ffffffe (USED)      Not needed object: [<?>]
 ## Note: there is no "string table at offset 0xb6..." warning here, because it was printed earlier.
 # BAD-STRING-GNU-NEXT:   0x000000000000000e (SONAME)    Library soname: [<?>]
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb7, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb7: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x000000000000000f (RPATH)     Library rpath: [<?>]
-# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb8, it goes past the end of the table (0xb1)
+# BAD-STRING-GNU-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb8: it goes past the end of the table (0xb1)
 # BAD-STRING-GNU-NEXT:   0x000000000000001d (RUNPATH)   Library runpath: [<?>]
 # BAD-STRING-GNU-NEXT:   0x0000000000000000 (NULL)      0x0
 
 --- !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB
   Type:    ET_EXEC
ProgramHeaders:
   - Type: PT_LOAD
     VAddr: 0x1000
     Sections:
       - Section: .dynamic
   - Type: PT_DYNAMIC
     VAddr: 0x1000
     Sections:
       - Section: .dynamic
+
+## Check how we handle cases when the dynamic string table is not null-terminated.
+
+## Case A: the value of the DT_STRSZ tag is equal to the size of
+##         the not null-terminated dynamic string table.
+# RUN: yaml2obj %s -DSTRSZ=7 --docnum=6 -o %t6
+# RUN: llvm-readobj --dynamic-table %t6 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t6 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-GREQ
+# RUN: llvm-readelf --dynamic-table %t6 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t6 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-GREQ
+
+## Case B: the value of the DT_STRSZ tag is less than the size of
+##         the not null-terminated dynamic string table.
+# RUN: yaml2obj %s -DSTRSZ=6 --docnum=6 -o %t7
+# RUN: llvm-readobj --dynamic-table %t7 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t7 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-LESS
+# RUN: llvm-readelf --dynamic-table %t7 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t7 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-LESS
+
+## Case C: the value of the DT_STRSZ tag is one byte larger than the size of
+##         the not null-terminated dynamic string table.
+# RUN: yaml2obj %s -DSTRSZ=8 --docnum=6 -o %t8
+# RUN: llvm-readobj --dynamic-table %t8 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t8 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-GREQ
+# RUN: llvm-readelf --dynamic-table %t8 2>&1 | \
+# RUN:   FileCheck %s -DFILE=%t8 --implicit-check-not=warning: --check-prefixes=NOT-TERMINATED,NOT-TERMINATED-GREQ
+
+# NOT-TERMINATED:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb4: the string table is not null-terminated
+# NOT-TERMINATED:      warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb0: the string table is not null-terminated
+# NOT-TERMINATED-NEXT: {{[(]?}}NEEDED{{[)]?}}    Shared library: [<?>]
+# NOT-TERMINATED-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb1: the string table is not null-terminated
+# NOT-TERMINATED-NEXT: {{[(]?}}FILTER{{[)]?}}    Filter library: [<?>]
+# NOT-TERMINATED-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb2: the string table is not null-terminated
+# NOT-TERMINATED-NEXT: {{[(]?}}AUXILIARY{{[)]?}} Auxiliary library: [<?>]
+# NOT-TERMINATED-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb3: the string table is not null-terminated
+# NOT-TERMINATED-NEXT: {{[(]?}}USED{{[)]?}}      Not needed object: [<?>]
+# NOT-TERMINATED-NEXT: {{[(]?}}SONAME{{[)]?}}    Library soname: [<?>]
+# NOT-TERMINATED-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb5: the string table is not null-terminated
+# NOT-TERMINATED-NEXT: {{[(]?}}RPATH{{[)]?}}     Library rpath: [<?>]
+# NOT-TERMINATED-GREQ-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6: the string table is not null-terminated
+# NOT-TERMINATED-LESS-NEXT: warning: '[[FILE]]': string table at offset 0xb0: unable to read the string at 0xb6: it goes past the end of the table (0xb6)
+# NOT-TERMINATED-NEXT: {{[(]?}}RUNPATH{{[)]?}}   Library runpath: [<?>]
+# NOT-TERMINATED-NEXT: {{[(]?}}NULL{{[)]?}}      0x0
+
+--- !ELF
+FileHeader:
+  Class:   ELFCLASS64
+  Data:    ELFDATA2LSB
+  Type:    ET_EXEC
+  Machine: EM_X86_64
+Sections:
+  - Name:    .dynstr
+    Type:    SHT_STRTAB
+    Address: 0x1000
+    Content: '746573742e736f' ## "test.so", not null terminated.
+  - Type:    Fill
+    Pattern: "61626300" ## 'a', 'b', 'c', '\0'.
+    Size:    "4"
+  - Name:    .dynamic
+    Type:    SHT_DYNAMIC
+    Address: 0x1100
+    Entries:
+      - Tag:   DT_STRTAB
+        Value: 0x1000
+      - Tag:   DT_STRSZ
+        Value: [[STRSZ]]
+      - Tag:   DT_NEEDED
+        Value: 0
+      - Tag:   DT_FILTER
+        Value: 1
+      - Tag:   DT_AUXILIARY
+        Value: 2
+      - Tag:   DT_USED
+        Value: 3
+      - Tag:   DT_SONAME
+        Value: 4
+      - Tag:   DT_RPATH
+        Value: 5
+      - Tag:   DT_RUNPATH
+        Value: 6
+      - Tag:   DT_NULL
+        Value: 0
+ProgramHeaders:
+  - Type: PT_LOAD
+    VAddr: 0x1000
+    Sections:
+      - Section: .dynstr
+      - Section: .dynamic
+  - Type: PT_DYNAMIC
+    VAddr: 0x1100
+    Sections:
+      - Section: .dynamic
+
+## Check that we emit an appropriate warning when the dynamic string table ends past the end of the file.
+
+## Case A: the value of DT_STRSZ tag is set so that the string table ends
+## right before the EOF. No warning should be emitted.
+# RUN: yaml2obj %s -DSTRSZ=0x210 --docnum=6 -o %t9.1
+# RUN: llvm-readobj --dynamic-table %t9.1 | \
+# RUN:   FileCheck %s --implicit-check-not=warning: --check-prefix=BEFORE-THE-EOF
+# RUN: llvm-readelf --dynamic-table %t9.1 | \
+# RUN:   FileCheck %s --implicit-check-not=warning: --check-prefix=BEFORE-THE-EOF
+
+## Note: The code reads the data in [DT_STRTAB, DT_STRTAB + DT_STRSZ] as the string table
+## as normal. Since the file ends with a zero byte, strings are dumped, but if it didn't,
+## we'd get <?> printed instead. The important bit is that we don't get the past the end warning.
+
+# BEFORE-THE-EOF:      {{[(]?}}NEEDED{{[)]?}}    Shared library: [test.soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}FILTER{{[)]?}}    Filter library: [est.soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}AUXILIARY{{[)]?}} Auxiliary library: [st.soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}USED{{[)]?}}      Not needed object: [t.soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}SONAME{{[)]?}}    Library soname: [.soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}RPATH{{[)]?}}     Library rpath: [soabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}RUNPATH{{[)]?}}   Library runpath: [oabc]
+# BEFORE-THE-EOF-NEXT: {{[(]?}}NULL{{[)]?}}      0x0
+
+## Case B: the value of DT_STRSZ tag is set so that the string table goes 1 byte past the EOF.
+# RUN: yaml2obj %s -DSTRSZ=0x211 --docnum=6 -o %t9.2
+# RUN: llvm-readobj --dynamic-table %t9.2 2>&1 | FileCheck %s -DFILE=%t9.2 --check-prefix=PAST-THE-EOF
+# RUN: llvm-readelf --dynamic-table %t9.2 2>&1 | FileCheck %s -DFILE=%t9.2 --check-prefix=PAST-THE-EOF
+
+# PAST-THE-EOF:      warning: '[[FILE]]': string table at offset 0xb0 with size 0x211 goes past the end of the file (0x2c0)
+# PAST-THE-EOF:      {{[(]?}}NEEDED{{[)]?}}    Shared library: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}FILTER{{[)]?}}    Filter library: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}AUXILIARY{{[)]?}} Auxiliary library: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}USED{{[)]?}}      Not needed object: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}SONAME{{[)]?}}    Library soname: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}RPATH{{[)]?}}     Library rpath: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}RUNPATH{{[)]?}}   Library runpath: [<?>]
+# PAST-THE-EOF-NEXT: {{[(]?}}NULL{{[)]?}}      0x0

llvm/test/tools/llvm-readobj/ELF/loadname.test

 ## Check we are able to dump library soname properly.
 
 ## Test a valid object case first. We set 'FileSize' to 0x48, because this is a no-op,
 ## i.e. this value would be set if we had no 'FileSize' at all.
 # RUN: yaml2obj -DDTSTRTABVAL=0x0 -DPHDRFILESIZE="0x48" %s -o %t.o
 # RUN: llvm-readobj %t.o | FileCheck %s --check-prefix LLVM
 # RUN: llvm-readelf --dynamic-table %t.o | FileCheck %s --check-prefix GNU
 
 # LLVM:      Format: elf64-x86-64
 # LLVM-NEXT: Arch: x86_64
 # LLVM-NEXT: AddressSize: 64bit
 # LLVM-NEXT: LoadName: test.so
 
 # GNU:       Dynamic section at offset 0x80 contains 4 entries:
 # GNU-NEXT:   Tag                Type     Name/Value
 # GNU-NEXT:   0x0000000000000005 (STRTAB) 0x0
-# GNU-NEXT:   0x000000000000000a (STRSZ)  7 (bytes)
+# GNU-NEXT:   0x000000000000000a (STRSZ)  8 (bytes)
 # GNU-NEXT:   0x000000000000000e (SONAME) Library soname: [test.so]
 # GNU-NEXT:   0x0000000000000000 (NULL)   0x0
 
 !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB
   Type:    ET_EXEC
   Machine: EM_X86_64
 Sections:
   - Name:  .dynstr
     Type:  SHT_STRTAB
     Flags: [ SHF_ALLOC ]
     Content: '746573742e736f00' ## "test.so"
   - Name:  .dynamic
     Type:  SHT_DYNAMIC
     Flags: [ SHF_ALLOC ]
     Link:  .dynstr
     Entries:
       - Tag:   DT_STRTAB
         Value: [[DTSTRTABVAL]]
       - Tag:   DT_STRSZ
-        Value: 0x0000000000000007
+        Value: 0x0000000000000008
       - Tag:   DT_SONAME
         Value: 0x0000000000000000
       - Tag:   DT_NULL
         Value: 0x0000000000000000
 ProgramHeaders:
   - Type:     PT_LOAD
     Flags:    [ PF_R ]
     VAddr:    0x0000

llvm/test/tools/llvm-readobj/ELF/needed-libs.test

 ## In this test we check the --needed-libs option.
 
 # RUN: yaml2obj %s --docnum=1 -o %t1
 # RUN: llvm-readobj --needed-libs %t1 2>&1 \
 # RUN:   | FileCheck %s -DFILE=%t1 --implicit-check-not=warning: --strict-whitespace --check-prefix=NEEDED-LIBS
 # RUN: llvm-readelf --needed-libs %t1 2>&1 \
 # RUN:   | FileCheck %s -DFILE=%t1 --implicit-check-not=warning: --strict-whitespace --check-prefix=NEEDED-LIBS
 
 ## Check that library names are sorted when printed.
 ## Document that we also sort error entries.
 
 #      NEEDED-LIBS:{{^}}NeededLibraries [{{$}}
-# NEEDED-LIBS-NEXT:  warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x9999a11, it goes past the end of the table (0x85){{$}}
-# NEEDED-LIBS-NEXT:  warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x1111189, it goes past the end of the table (0x85){{$}}
+# NEEDED-LIBS-NEXT:  warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x9999a11: it goes past the end of the table (0x85){{$}}
+# NEEDED-LIBS-NEXT:  warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x1111189: it goes past the end of the table (0x85){{$}}
 # NEEDED-LIBS-NEXT:{{^}}  <?>{{$}}
 # NEEDED-LIBS-NEXT:{{^}}  <?>{{$}}
 # NEEDED-LIBS-NEXT:{{^}}  aaa{{$}}
 # NEEDED-LIBS-NEXT:{{^}}  bbb{{$}}
 # NEEDED-LIBS-NEXT:{{^}}  ccc{{$}}
 # NEEDED-LIBS-NEXT:{{^}}]{{$}}
 
 --- !ELF

 
 ## Check what we print when the dynamic string table is empty.
 # RUN: yaml2obj %s --docnum=2 -o %t2
 # RUN: llvm-readobj --needed-libs %t2 2>&1 | \
 # RUN:   FileCheck %s -DFILE=%t2 --implicit-check-not=warning: --check-prefixes=EMPTY-DYNSTR,EMPTY-DYNSTR-LLVM
 # RUN: llvm-readelf --needed-libs %t2 2>&1 | \
 # RUN:   FileCheck %s -DFILE=%t2 --implicit-check-not=warning: --check-prefix=EMPTY-DYNSTR
 
-# EMPTY-DYNSTR:      warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x78, it goes past the end of the table (0x78)
+# EMPTY-DYNSTR:      warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x78: it goes past the end of the table (0x78)
 # EMPTY-DYNSTR-LLVM: LoadName: <?>
 # EMPTY-DYNSTR:      NeededLibraries [
-# EMPTY-DYNSTR-NEXT: warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x79, it goes past the end of the table (0x78)
-# EMPTY-DYNSTR-NEXT: warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x7a, it goes past the end of the table (0x78)
+# EMPTY-DYNSTR-NEXT: warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x79: it goes past the end of the table (0x78)
+# EMPTY-DYNSTR-NEXT: warning: '[[FILE]]': string table at offset 0x78: unable to read the string at 0x7a: it goes past the end of the table (0x78)
 # EMPTY-DYNSTR-NEXT:   <?>
 # EMPTY-DYNSTR-NEXT:   <?>
 # EMPTY-DYNSTR-NEXT: ]
 
 --- !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB

llvm/tools/llvm-readobj/ELFDumper.cpp

case DT_FLAGS_1:
     return FormatFlags(Value, makeArrayRef(ElfDynamicDTFlags1));
   default:
     return FormatHexValue(Value);
   }
 }
 
 template <class ELFT>
 StringRef ELFDumper<ELFT>::getDynamicString(uint64_t Value) const {
-  auto WarnAndReturn = [this](const Twine &Msg) {
-    reportUniqueWarning(createError(Msg));
+  if (DynamicStringTable.empty() && !DynamicStringTable.data()) {
+    reportUniqueWarning(createError("string table was not found"));
     return "<?>";
-  };
-
-  if (DynamicStringTable.empty() && !DynamicStringTable.data())
-    return WarnAndReturn("string table was not found");
+  }
 
-  if (Value < DynamicStringTable.size())
-    return DynamicStringTable.data() + Value;
+  auto WarnAndReturn = [this](const Twine &Msg, uint64_t Offset) {
+    reportUniqueWarning(createError("string table at offset 0x" +
+                                    Twine::utohexstr(Offset) + Msg));
+    return "<?>";
+  };
 
+  const uint64_t FileSize = ObjF->getELFFile()->getBufSize();
   const uint64_t Offset =
       (const uint8_t *)DynamicStringTable.data() - ObjF->getELFFile()->base();
+  if (DynamicStringTable.size() > FileSize - Offset)
+    return WarnAndReturn(" with size 0x" +
+                             Twine::utohexstr(DynamicStringTable.size()) +
+                             " goes past the end of the file (0x" +
+                             Twine::utohexstr(FileSize) + ")",
+                         Offset);
+
+  if (Value >= DynamicStringTable.size())
     return WarnAndReturn(
-      "string table at offset 0x" + Twine::utohexstr(Offset) +
         ": unable to read the string at 0x" + Twine::utohexstr(Offset + Value) +
-      ", it goes past the end of the table (0x" +
-      Twine::utohexstr(Offset + DynamicStringTable.size()) + ")");
+            ": it goes past the end of the table (0x" +
+            Twine::utohexstr(Offset + DynamicStringTable.size()) + ")",
+        Offset);
+
+  if (DynamicStringTable.back() != '\0')
+    return WarnAndReturn(": unable to read the string at 0x" +
+                             Twine::utohexstr(Offset + Value) +
+                             ": the string table is not null-terminated",
+                         Offset);
+
+  return DynamicStringTable.data() + Value;
 }
 
 template <class ELFT> void ELFDumper<ELFT>::printUnwindInfo() {
   DwarfCFIEH::PrinterContext<ELFT> Ctx(W, ObjF);
   Ctx.printUnwindInformation();
 }
 
 namespace {