[llvm-readobj/elf] - Don't crash when the size of a dynamic symbol table, inferred from the hash table, is broken.

[grimar]

Summary

Currently we might derive the dynamic symbol table size from the DT_HASH hash table (using its nchain field).
It is possible to crash dumpers with a broken relocation that refers to a symbol with an index
that is too large. To trigger it, the inferred size of the dynamic symbol table should go past the end of the object.

This patch adds a size validation + warning.

[MaskRay]

llvm/tools/llvm-readobj/ELFDumper.cpp

2261

Do you mean "the hash table size (0x...) derived from ..." ?

[jhenderson]

llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

330

339

Here and below, I'd prefer it if we can avoid hard coding the values into the CHECKs, because if the yaml2obj layout changes at all, these values will have to be updated.

Can you use FileCheck numeric variables to capture the sizes according to the section headers and the file size somewhere, and then use those?

[grimar]

• Addressed review comments.

llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

339

Done.

llvm/tools/llvm-readobj/ELFDumper.cpp

2261

Nope. This message is about the size of the dynamic symbol table. This size was derived from the hash table
and the value is too large to be used as a size of the dynamic symbol table.

[jhenderson]

llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

340

I don't think you need the {{^}} here and below, since the FileCheck value will start from the start of the number anyway, and we know it will be at the start of the file.

340–341

Be consistent with your spacing after the , in the FileCheck numeric variables. I don't mind which you use, but you've got some cases with a space after it, and others without.

llvm/tools/llvm-readobj/ELFDumper.cpp

2261–2265

I'm not sure I like this message. The first clause, whilst I can figure out what it means, feels very clunky. I think your best option is "The size (0x1234), derived from the hash table, of the dynamic symbol table..." or "The size (0x1234) of the dynamic symbol table at 0x1234, derived from the hash table, goes past ..."

[grimar]

• Addressed review comments.

llvm/tools/llvm-readobj/ELFDumper.cpp

2261–2265

Fixed, thanks!

[jhenderson]

LGTM!

[thakis]

Looks like this breaks tests on mac: http://45.33.8.238/mac/20491/step_11.txt

Please take a look and revert for now if it takes a while to fix.

[grimar]

In D86923#2275328, @thakis wrote:

Looks like this breaks tests on mac: http://45.33.8.238/mac/20491/step_11.txt

Please take a look and revert for now if it takes a while to fix.

Thanks for letting me know. Fixed in rGef4851742de5e64a1ba9de51e375ac503d2d7ecb.

[grimar]

llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

340

note: there is a solid reason not to use {{^}} here:
I've tested on mac that wc -c does not start printing from the begining of the line, it adds whitespaces.
So with {{^}} it just doesn't pass there.

[phosek]

In D86923#2276286, @grimar wrote:

In D86923#2275328, @thakis wrote:

Looks like this breaks tests on mac: http://45.33.8.238/mac/20491/step_11.txt

Please take a look and revert for now if it takes a while to fix.

Thanks for letting me know. Fixed in rGef4851742de5e64a1ba9de51e375ac503d2d7ecb.

We're still seeing a failure on macOS:

/b/s/w/ir/k/llvm-project/llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test:356:23: error: BROKEN-NCHAIN-LLVM: expected string not found in input
# BROKEN-NCHAIN-LLVM: {{^}}[[#%u, FILESIZE:]]
                      ^
/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt:1:2: note: scanning from here
 840 /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
 ^
/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt:13:5: note: possible intended match here
 Name: (0)
    ^

Input file: /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt
Check file: /b/s/w/ir/k/llvm-project/llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

-dump-input=help explains the following input dump.

Input was:
<<<<<<
             1:  840 /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
check:356'0      X~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ error: no match found
             2: /b/s/w/ir/k/staging/llvm_build/bin/llvm-readobj: warning: '/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1': hash table nchain (4294967295) differs from symbol count derived from SHT_DYNSYM section header (1)
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             3: /b/s/w/ir/k/staging/llvm_build/bin/llvm-readobj: warning: '/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1': the size (0x17ffffffe8) of the dynamic symbol table at 0xf0, derived from the hash table, goes past the end of the file (0x348) and will be ignored
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             4: 
check:356'0     ~
             5: File: /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             6: Format: elf64-x86-64
check:356'0     ~~~~~~~~~~~~~~~~~~~~
             7: Arch: x86_64
check:356'0     ~~~~~~~~~~~~
             8: AddressSize: 64bit
check:356'0     ~~~~~~~~~~~~~~~~~~
             9: LoadName: 
check:356'0     ~~~~~~~~~~
            10: Sections [
check:356'0     ~~~~~~~~~~
            11:  Section {
check:356'0     ~~~~~~~~~~
            12:  Index: 0
check:356'0     ~~~~~~~~~
            13:  Name: (0)
check:356'0     ~~~~~~~~~~
check:356'1         ?      possible intended match
            14:  Type: SHT_NULL (0x0)
check:356'0     ~~~~~~~~~~~~~~~~~~~~~
            15:  Flags [ (0x0)
check:356'0     ~~~~~~~~~~~~~~
            16:  ]
check:356'0     ~~
            17:  Address: 0x0
check:356'0     ~~~~~~~~~~~~~
            18:  Offset: 0x0
check:356'0     ~~~~~~~~~~~~
             .
             .
             .
>>>>>>

[phosek]

In D86923#2287049, @phosek wrote:

In D86923#2276286, @grimar wrote:

In D86923#2275328, @thakis wrote:

Looks like this breaks tests on mac: http://45.33.8.238/mac/20491/step_11.txt

Please take a look and revert for now if it takes a while to fix.

Thanks for letting me know. Fixed in rGef4851742de5e64a1ba9de51e375ac503d2d7ecb.

We're still seeing a failure on macOS:

/b/s/w/ir/k/llvm-project/llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test:356:23: error: BROKEN-NCHAIN-LLVM: expected string not found in input
# BROKEN-NCHAIN-LLVM: {{^}}[[#%u, FILESIZE:]]
                      ^
/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt:1:2: note: scanning from here
 840 /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
 ^
/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt:13:5: note: possible intended match here
 Name: (0)
    ^

Input file: /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.out.llvm.txt
Check file: /b/s/w/ir/k/llvm-project/llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

-dump-input=help explains the following input dump.

Input was:
<<<<<<
             1:  840 /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
check:356'0      X~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ error: no match found
             2: /b/s/w/ir/k/staging/llvm_build/bin/llvm-readobj: warning: '/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1': hash table nchain (4294967295) differs from symbol count derived from SHT_DYNSYM section header (1)
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             3: /b/s/w/ir/k/staging/llvm_build/bin/llvm-readobj: warning: '/b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1': the size (0x17ffffffe8) of the dynamic symbol table at 0xf0, derived from the hash table, goes past the end of the file (0x348) and will be ignored
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             4: 
check:356'0     ~
             5: File: /b/s/w/ir/k/staging/llvm_build/test/tools/llvm-readobj/ELF/Output/dyn-symbols-size-from-hash-table.test.tmp4.1
check:356'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             6: Format: elf64-x86-64
check:356'0     ~~~~~~~~~~~~~~~~~~~~
             7: Arch: x86_64
check:356'0     ~~~~~~~~~~~~
             8: AddressSize: 64bit
check:356'0     ~~~~~~~~~~~~~~~~~~
             9: LoadName: 
check:356'0     ~~~~~~~~~~
            10: Sections [
check:356'0     ~~~~~~~~~~
            11:  Section {
check:356'0     ~~~~~~~~~~
            12:  Index: 0
check:356'0     ~~~~~~~~~
            13:  Name: (0)
check:356'0     ~~~~~~~~~~
check:356'1         ?      possible intended match
            14:  Type: SHT_NULL (0x0)
check:356'0     ~~~~~~~~~~~~~~~~~~~~~
            15:  Flags [ (0x0)
check:356'0     ~~~~~~~~~~~~~~
            16:  ]
check:356'0     ~~
            17:  Address: 0x0
check:356'0     ~~~~~~~~~~~~~
            18:  Offset: 0x0
check:356'0     ~~~~~~~~~~~~
             .
             .
             .
>>>>>>

Never mind, looks like rGef4851742de5e64a1ba9de51e375ac503d2d7ecb addressed it.

llvm/test/tools/llvm-readobj/ELF/dyn-symbols-size-from-hash-table.test

 # RUN: llvm-strip --strip-sections %t3
 # RUN: llvm-readobj --dyn-symbols %t3 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=LLVM3 --implicit-check-not=warning:
 # RUN: llvm-readelf --dyn-symbols %t3 2>&1 | \
 # RUN:   FileCheck %s --implicit-check-not={{.}} --allow-empty
 
 # LLVM3: DynamicSymbols [
 # LLVM3: ]
+
+## Case 4: The size of the dynamic symbol table, inferred from the hash table, is broken.
+##         It is so large that symbol table goes past the end of the file. We have a dynamic
+##         relocation which refers to a symbol with an index that is also too large to be
+##         in the file. Check we report a warning when trying to dump this relocation.
+
+# RUN: yaml2obj --docnum=3 %s -o %t4.1
+
+## Remember the size of the output produced.
+# RUN: wc -c %t4.1 > %t4.out.gnu.txt
+# RUN: llvm-readelf --sections --dyn-relocations %t4.1 >> %t4.out.gnu.txt 2>&1
+# RUN: FileCheck %s -DFILE=%t4.1 --input-file=%t4.out.gnu.txt --check-prefix=BROKEN-NCHAIN-GNU
+
+# BROKEN-NCHAIN-GNU: [[#%u, FILESIZE:]]
+# BROKEN-NCHAIN-GNU: warning: '[[FILE]]': the size (0x17ffffffe8) of the dynamic symbol table at 0x[[#%x, DYNSYMOFF:]], derived from the hash table, goes past the end of the file (0x[[#%x, FILESIZE]]) and will be ignored
+
+# BROKEN-NCHAIN-GNU: [Nr] Name      Type   Address          Off
+# BROKEN-NCHAIN-GNU: [ 1] .rela.plt RELA   0000000000001000 0000[[#%x, RELAOFF:]]
+# BROKEN-NCHAIN-GNU: [ 4] .dynsym   DYNSYM 0000000000001078 0000[[#%x, DYNSYMOFF]]
+
+# BROKEN-NCHAIN-GNU:      'PLT' relocation section at offset 0x[[#%x, RELAOFF]] contains 24 bytes:
+# BROKEN-NCHAIN-GNU-NEXT: Offset            Info             Type              Symbol's Value  Symbol's Name + Addend
+# BROKEN-NCHAIN-GNU-NEXT: warning: '[[FILE]]': unable to get name of the dynamic symbol with index 4292739037: index is greater than or equal to the number of dynamic symbols (1)
+# BROKEN-NCHAIN-GNU-NEXT: 0000000000000000  ffddffdd00000000 R_X86_64_NONE                     <corrupt> + 0
+
+# RUN: wc -c %t4.1 > %t4.out.llvm.txt
+# RUN: llvm-readobj --sections --dyn-relocations %t4.1 2>&1 >> %t4.out.llvm.txt 2>&1
+# RUN: FileCheck %s -DFILE=%t4.1 --input-file=%t4.out.llvm.txt --check-prefix=BROKEN-NCHAIN-LLVM
+
+# BROKEN-NCHAIN-LLVM: {{^}}[[#%u, FILESIZE:]]
+# BROKEN-NCHAIN-LLVM: warning: '[[FILE]]': the size (0x17ffffffe8) of the dynamic symbol table at 0x[[#%x, DYNSYMOFF:]], derived from the hash table, goes past the end of the file (0x[[#%x, FILESIZE]]) and will be ignored
+
+# BROKEN-NCHAIN-LLVM:      Name: .dynsym
+# BROKEN-NCHAIN-LLVM-NEXT: Type: SHT_DYNSYM
+# BROKEN-NCHAIN-LLVM-NEXT: Flags [
+# BROKEN-NCHAIN-LLVM-NEXT:   SHF_ALLOC
+# BROKEN-NCHAIN-LLVM-NEXT: ]
+# BROKEN-NCHAIN-LLVM-NEXT: Address: 0x1078
+# BROKEN-NCHAIN-LLVM-NEXT: Offset: 0x[[#%X, DYNSYMOFF]]
+
+# BROKEN-NCHAIN-LLVM:      Dynamic Relocations {
+# BROKEN-NCHAIN-LLVM-NEXT: warning: '[[FILE]]': unable to get name of the dynamic symbol with index 4292739037: index is greater than or equal to the number of dynamic symbols (1)
+# BROKEN-NCHAIN-LLVM-NEXT:   0x0 R_X86_64_NONE <corrupt> 0x0
+# BROKEN-NCHAIN-LLVM-NEXT: }
+
+--- !ELF
+FileHeader:
+  Class:   ELFCLASS64
+  Data:    ELFDATA2LSB
+  Type:    ET_EXEC
+  Machine: EM_X86_64
+Sections:
+  - Name:    .rela.plt
+    Type:    SHT_RELA
+    Flags:   [ SHF_ALLOC ]
+    Address: 0x1000
+    Relocations:
+      - Type:   R_X86_64_NONE
+        Symbol: 0xFFDDFFDD
+  - Name:  .dynamic
+    Type:  SHT_DYNAMIC
+    Flags: [ SHF_ALLOC ]
+    Entries:
+      - Tag:   DT_PLTRELSZ
+        Value: 0x18
+      - Tag:   DT_JMPREL
+## 0x1000 - PT_LOAD's p_vaddr (0x1000) == 0x0.
+## 0x0 + PT_LOAD's p_offset (0x78) == .rela.plt section offset (0x78).
+        Value: 0x1000
+      - Tag:   DT_PLTREL
+        Value: 0x7 ## 7 == DT_RELA
+      - Tag:   DT_HASH
+## 0x1068 - PT_LOAD's p_vaddr (0x1000) == 0x68.
+## 0x68 + PT_LOAD's p_offset (0x78) == .hash section offset (0xE0).
+        Value: 0x1068
+      - Tag:   DT_NULL
+        Value: 0x0
+  - Name:   .hash
+    Type:   SHT_HASH
+    Flags:  [ SHF_ALLOC ]
+    Bucket: [ 0 ]
+    Chain:  [ 0 ]
+    NChain: 0xFFFFFFFF
+DynamicSymbols: []
+ProgramHeaders:
+  - Type: PT_LOAD
+    Sections:
+      - Section: .rela.plt
+      - Section: .dynamic
+      - Section: .hash
+    VAddr: 0x1000

llvm/test/tools/llvm-readobj/ELF/hash-histogram.test

 # ERR2: warning: '[[FILE]]': the hash table at offset 0x54 goes past the end of the file (0x1d4), nbucket = 94, nchain = 1{{$}}
 
 ## Case B.1: the hash table ends right before the EOF. We have a broken nchain
 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=4 %s -o %t4.3.o -DNBUCKET=0x1 -DNCHAIN=0x5d
 # RUN: llvm-readelf --elf-hash-histogram %t4.3.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=ERR3 -DFILE=%t4.3.o --implicit-check-not="warning:"
 # ERR3: warning: '[[FILE]]': hash table nchain (93) differs from symbol count derived from SHT_DYNSYM section header (1){{$}}
+# ERR3: warning: '[[FILE]]': the size (0x5d0) of the dynamic symbol table at 0x78, derived from the hash table, goes past the end of the file (0x1d4) and will be ignored
 
 ## Case B.2: the hash table ends 1 byte past the EOF. We have a broken nchain
 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=4 %s -o %t4.4.o -DNBUCKET=0x1 -DNCHAIN=0x5e
 # RUN: llvm-readelf --elf-hash-histogram %t4.4.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=ERR4 -DFILE=%t4.4.o --implicit-check-not="warning:"
 # ERR4: warning: '[[FILE]]': hash table nchain (94) differs from symbol count derived from SHT_DYNSYM section header (1){{$}}
+# ERR4: warning: '[[FILE]]': the size (0x5e0) of the dynamic symbol table at 0x78, derived from the hash table, goes past the end of the file (0x1d4) and will be ignored
 # ERR4: warning: '[[FILE]]': the hash table at offset 0x54 goes past the end of the file (0x1d4), nbucket = 1, nchain = 94{{$}}
 
 --- !ELF
 FileHeader:
   Class: ELFCLASS32
   Data:  ELFDATA2LSB
   Type:  ET_DYN
 Sections:

llvm/test/tools/llvm-readobj/ELF/hash-symbols.test

 # ERR2-NOT:  {{.}}
 
 ## Case B.1: the hash table ends right before the EOF. We have a broken nchain
 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=7 %s -o %t7.3.o -DNCHAIN=0x5d
 # RUN: llvm-readelf --hash-symbols %t7.3.o 2>&1 | \
 # RUN:   FileCheck %s --implicit-check-not="warning:" --check-prefix=NOERR2 -DFILE=%t7.3.o
 # NOERR2:      warning: '[[FILE]]': hash table nchain (93) differs from symbol count derived from SHT_DYNSYM section header (1)
+# NOERR2:      warning: '[[FILE]]': the size (0x5d0) of the dynamic symbol table at 0x78, derived from the hash table, goes past the end of the file (0x1d4) and will be ignored
 # NOERR2:      Symbol table of .hash for image:
 # NOERR2-NEXT: Num Buc: Value Size Type Bind Vis Ndx Name
 # NOERR2-NOT:  {{.}}
 
 ## Case B.2: the hash table ends 1 byte past the EOF. We have a broken nchain
 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=7 %s -o %t7.4.o -DNCHAIN=0x5e
 # RUN: llvm-readelf --hash-symbols %t7.4.o 2>&1 | FileCheck %s --check-prefix=ERR3 -DFILE=%t7.4.o

llvm/test/tools/llvm-readobj/ELF/hash-table.test

 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=4 %s -o %t5.3.o -DNBUCKET=0x1 -DNCHAIN=0x5d
 # RUN: llvm-readelf --hash-table %t5.3.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=NOERR2 -DFILE=%t5.3.o --implicit-check-not="warning:"
 # RUN: llvm-readobj --hash-table %t5.3.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=NOERR2 -DFILE=%t5.3.o --implicit-check-not="warning:"
 
 # NOERR2:      warning: '[[FILE]]': hash table nchain (93) differs from symbol count derived from SHT_DYNSYM section header (1)
+# NOERR2:      warning: '[[FILE]]': the size (0x5d0) of the dynamic symbol table at 0x78, derived from the hash table, goes past the end of the file (0x1d4) and will be ignored
 # NOERR2:      HashTable {
 # NOERR2-NEXT:   Num Buckets: 1
 # NOERR2-NEXT:   Num Chains: 93
 # NOERR2-NEXT:   Buckets: [0]
 ## Here we would dump the rest of the file as chain array because we have a broken nchain field.
 ## No need to check what we dump, we only want to test that we have no unexpected warnings/crashes.
 # NOERR2-NEXT:   Chains:
 # NOERR2-NEXT: }
 
 ## Case B.2: the hash table ends 1 byte past the EOF. We have a broken nchain
 ##           field that has a value larger than the number of chains.
 # RUN: yaml2obj --docnum=4 %s -o %t5.4.o -DNBUCKET=0x1 -DNCHAIN=0x5e
 # RUN: llvm-readelf --hash-table %t5.4.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=ERR3 -DFILE=%t5.4.o --implicit-check-not="warning:"
 # RUN: llvm-readobj --hash-table %t5.4.o 2>&1 | \
 # RUN:   FileCheck %s --check-prefix=ERR3 -DFILE=%t5.4.o --implicit-check-not="warning:"
 
 # ERR3:      warning: '[[FILE]]': hash table nchain (94) differs from symbol count derived from SHT_DYNSYM section header (1)
+# ERR3:      warning: '[[FILE]]': the size (0x5e0) of the dynamic symbol table at 0x78, derived from the hash table, goes past the end of the file (0x1d4) and will be ignored
 # ERR3:      HashTable {
 # ERR3-NEXT:  Num Buckets: 1
 # ERR3-NEXT:  Num Chains: 94
 # ERR3-NEXT:  warning: '[[FILE]]': the hash table at offset 0x54 goes past the end of the file (0x1d4), nbucket = 1, nchain = 94{{$}}
 # ERR3-NEXT: }
 
 --- !ELF
 FileHeader:

llvm/tools/llvm-readobj/ELFDumper.cpp

if (!DynSymRegion) {
       DynSymRegion->Addr = DynSymFromTable->Addr;
       DynSymRegion->EntSize = DynSymFromTable->EntSize;
       DynSymRegion->EntSizePrintName = DynSymFromTable->EntSizePrintName;
     }
   }
 
   // Derive the dynamic symbol table size from the DT_HASH hash table, if
   // present.
-  if (HashTable && DynSymRegion)
+  if (HashTable && DynSymRegion) {
+    const uint64_t FileSize = ObjF->getELFFile()->getBufSize();
+    const uint64_t DerivedSize =
+        (uint64_t)HashTable->nchain * DynSymRegion->EntSize;
+    const uint64_t Offset =
+        (const uint8_t *)DynSymRegion->Addr - ObjF->getELFFile()->base();
+    if (DerivedSize > FileSize - Offset)
+      reportUniqueWarning(createError(
+          "the size (0x" + Twine::utohexstr(DerivedSize) +
+          ") of the dynamic symbol table at 0x" + Twine::utohexstr(Offset) +
+          ", derived from the hash table, goes past the end of the file (0x" +
+          Twine::utohexstr(FileSize) + ") and will be ignored"));
+    else
       DynSymRegion->Size = HashTable->nchain * DynSymRegion->EntSize;
   }
+}
 
 template <typename ELFT>
 typename ELFDumper<ELFT>::Elf_Rel_Range ELFDumper<ELFT>::dyn_rels() const {
   return DynRelRegion.getAsArrayRef<Elf_Rel>();
 }
 
 template <typename ELFT>
 typename ELFDumper<ELFT>::Elf_Rela_Range ELFDumper<ELFT>::dyn_relas() const {