str_table_entry resolves an ELF string-table entry from a 32-bit name field read out of the file (section->name, sym->name, dynsym->name):
it forms str_table_base + index, then only checks the pointer against the upper limit
index is capped at 0x7fffffff by the index < 0 check, but on a 32-bit build str_table_base + index can wrap below the base when the mapping sits high in the address space
the wrapped pointer is under str_table_limit so the check passes and strnlen then reads out of bounds
Compare index against the table size before forming the pointer.
jmestwa-coder
fdbfb28b90