[Vabian124]

What

Fixes #1666.

A dynamic symbol's file offset was base + index * 24, then checked with offset + 4 > size. Both additions wrap in 64-bit arithmetic. DT_OS_SYMTAB near the top of that range therefore lands inside the input, and the four bytes there are taken as st_name. With the tag set to 2^64 - 16 and symbol index 1, that read hit the ELF header and the conversion failed with Empty import symbol name instead of a bounds error.

The lookup now rejects a base past the image, an index that does not start in the bytes that remain, and a 4-byte st_name that does not fit. Each test uses subtraction, so the check itself cannot wrap. This path reads only st_name. It does not require the other 20 bytes of an Elf64_Sym. A later pass still requires the declared DT_OS_SYMTABSZ window; that requirement is unchanged.

#2196 bounds the same class of addition in the entry-point collector. #2331 reads a defined symbol's section index from this entry and still adds the offset before checking it.

Tested

Windows 11 (10.0.26200), WinLibs GCC 15.2.0, Ninja, Release, relinker-only:

cmake -S . -B build-relinker -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=g++ -DANYPS5_RELINKER_ONLY=ON -DBUILD_TESTING=ON

cmake --build build-relinker --parallel

ctest --test-dir build-relinker --output-on-failure --timeout 120 --parallel 4

41 tests passed, including symbol_table_bounds. That test keeps a valid SysV table and a valid OS-tag table, accepts a 48-byte OS symbol table that ends on the last byte of the file, and rejects a base past EOF, a base of 2^64 - 16, a base of 2^64 - 4 with symbol index 0, a symbol index past EOF, and a name field that crosses EOF. The 2^64 - 16 input is also rejected on the Linux output path, before that path's program-header layout runs. Before the fix, the same input exited 2 with Empty import symbol name.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• AI-assisted: yes

[github-actions]

Спасибо за ваш интерес к проекту! Извините, сейчас накопилось слишком много открытых PR. Пока мы разбираемся с ними, приём PR от новых участников - авторов, чьих коммитов ещё нет в main, - временно приостановлен. Поэтому этот PR автоматически закрыт. Это не оценка качества ваших изменений.

[boykopovar]

Thank you for your interest in the project! Sorry, there are currently too many open PRs. While we sort them out, accepting PRs from new contributors—authors whose commits haven't yet made it into main—is temporarily suspended. Therefore, this PR is automatically closed. This is not a quality review of your changes.