From f99ae94747c54e219ae61daec327d88268d3438a Mon Sep 17 00:00:00 2001
From: John Reiser <jreiser@BitWagon.com>
Date: Wed, 15 Apr 2020 13:44:35 -0700
Subject: [PATCH] More checking .e_shstrndx

https://github.com/upx/upx/issues/366
	modified:   p_vmlinx.cpp
---
 src/p_vmlinx.cpp | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/p_vmlinx.cpp b/src/p_vmlinx.cpp
index c6a8f5c1..bd35f8a7 100644
--- a/src/p_vmlinx.cpp
+++ b/src/p_vmlinx.cpp
@@ -104,7 +104,6 @@ PackVmlinuxBase<T>::compare_Phdr(void const *aa, void const *bb)
 template <class T>
 typename T::Shdr const *PackVmlinuxBase<T>::getElfSections()
 {
-    Shdr const *p;
     unsigned const e_shnum = ehdri.e_shnum;
     if (ehdri.e_shentsize != sizeof(*shdri)
     ||  (unsigned long)file_size < ehdri.e_shoff
@@ -114,7 +113,13 @@ typename T::Shdr const *PackVmlinuxBase<T>::getElfSections()
     shdri = new Shdr[(unsigned) e_shnum];
     fi->seek(ehdri.e_shoff, SEEK_SET);
     fi->readx(shdri, e_shnum * sizeof(*shdri));
-    p = &shdri[ehdri.e_shstrndx];  // supposed
+    unsigned const e_shstrndx = ehdri.e_shstrndx;
+    if (e_shnum <= e_shstrndx) {
+        char msg[50]; snprintf(msg, sizeof(msg),
+                "bad .e_shstrndx %#x", e_shstrndx);
+        throwCantPack(msg);
+    }
+    Shdr const *p = &shdri[e_shstrndx];
     if (Shdr::SHT_STRTAB==p->sh_type
     &&  p->sh_offset  <= ((unsigned long)file_size - sizeof(*shdri))
     &&  p->sh_size    <= ((unsigned long)file_size - p->sh_offset)