Merge branch 'upstream'

Change-Id: Ie20a924c8a6bd83cf404f236dd288a489ace62a0

12 files changed, 582 insertions, 28 deletions

diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog
index 4c9f4f6a..ede6d471 100644
--- a/libdwfl/ChangeLog
+++ b/libdwfl/ChangeLog
@@ -1,3 +1,9 @@
+2017-03-24  Mark Wielaard  <[email protected]>
+
+	* linux-core-attach.c (core_next_thread): If n_namesz == 0 then
+	the note name data is the empty string.
+	(dwfl_core_file_attach): Likewise.
+
 2017-02-15  Ulf Hermann  <[email protected]>
 
 	* linux-kernel-modules.c: Include system.h.
diff --git a/libdwfl/linux-core-attach.c b/libdwfl/linux-core-attach.c
index 93d0e46e..f82ed032 100644
--- a/libdwfl/linux-core-attach.c
+++ b/libdwfl/linux-core-attach.c
@@ -125,7 +125,8 @@ core_next_thread (Dwfl *dwfl __attribute__ ((unused)), void *dwfl_arg,
 							  &desc_offset)) > 0)
     {
       /* Do not check NAME for now, help broken Linux kernels.  */
-      const char *name = note_data->d_buf + name_offset;
+      const char *name = (nhdr.n_namesz == 0
+			  ? "" : note_data->d_buf + name_offset);
       const char *desc = note_data->d_buf + desc_offset;
       GElf_Word regs_offset;
       size_t nregloc;
@@ -178,7 +179,8 @@ core_set_initial_registers (Dwfl_Thread *thread, void *thread_arg_voidp)
   /* __libdwfl_attach_state_for_core already verified the note is there.  */
   assert (getnote_err != 0);
   /* Do not check NAME for now, help broken Linux kernels.  */
-  const char *name = note_data->d_buf + name_offset;
+  const char *name = (nhdr.n_namesz == 0
+		      ? "" : note_data->d_buf + name_offset);
   const char *desc = note_data->d_buf + desc_offset;
   GElf_Word regs_offset;
   size_t nregloc;
@@ -367,7 +369,8 @@ dwfl_core_file_attach (Dwfl *dwfl, Elf *core)
 				    &nhdr, &name_offset, &desc_offset)) > 0)
     {
       /* Do not check NAME for now, help broken Linux kernels.  */
-      const char *name = note_data->d_buf + name_offset;
+      const char *name = (nhdr.n_namesz == 0
+			  ? "" : note_data->d_buf + name_offset);
       const char *desc = note_data->d_buf + desc_offset;
       GElf_Word regs_offset;
       size_t nregloc;
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 8539cb56..23a4fb93 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,13 @@
+2017-03-27  Mark Wielaard  <[email protected]>
+
+	* elf32_updatefile.c (updatemmap): Always update last_positition.
+	(updatefile): Likewise.
+
+2017-03-24  Mark Wielaard  <[email protected]>
+
+	* elf_compress.c (__libelf_decompress): Check insane compression
+	ratios before trying to allocate output buffer.
+
 2016-10-11  Akihiko Odaki  <[email protected]>
 	    Mark Wielaard  <[email protected]>
 
diff --git a/libelf/elf32_updatefile.c b/libelf/elf32_updatefile.c
index 8dd85d1a..7ac99510 100644
--- a/libelf/elf32_updatefile.c
+++ b/libelf/elf32_updatefile.c
@@ -343,9 +343,10 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf, int change_bo, size_t shnum)
 		  {
 		    fill_mmap (dl->data.d.d_off, last_position, scn_start,
 		               shdr_start, shdr_end);
-		    last_position = scn_start + dl->data.d.d_off;
 		  }
 
+		last_position = scn_start + dl->data.d.d_off;
+
 		if ((scn->flags | dl->flags | elf->flags) & ELF_F_DIRTY)
 		  {
 		    /* Let it go backward if the sections use a bogus
@@ -353,8 +354,6 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf, int change_bo, size_t shnum)
 		       user's section data with the latest one, rather than
 		       crashing.  */
 
-		    last_position = scn_start + dl->data.d.d_off;
-
 		    if (unlikely (change_bo))
 		      {
 #if EV_NUM != 2
@@ -728,6 +727,8 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf, int change_bo, size_t shnum)
 		      }
 		  }
 
+		last_offset = scn_start + dl->data.d.d_off;
+
 		if ((scn->flags | dl->flags | elf->flags) & ELF_F_DIRTY)
 		  {
 		    char tmpbuf[MAX_TMPBUF];
@@ -738,8 +739,6 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf, int change_bo, size_t shnum)
 		       user's section data with the latest one, rather than
 		       crashing.  */
 
-		    last_offset = scn_start + dl->data.d.d_off;
-
 		    if (unlikely (change_bo))
 		      {
 #if EV_NUM != 2
diff --git a/libelf/elf_compress.c b/libelf/elf_compress.c
index dac0ac6d..711be591 100644
--- a/libelf/elf_compress.c
+++ b/libelf/elf_compress.c
@@ -211,6 +211,15 @@ void *
 internal_function
 __libelf_decompress (void *buf_in, size_t size_in, size_t size_out)
 {
+  /* Catch highly unlikely compression ratios so we don't allocate
+     some giant amount of memory for nothing. The max compression
+     factor 1032:1 comes from http://www.zlib.net/zlib_tech.html  */
+  if (unlikely (size_out / 1032 > size_in))
+    {
+      __libelf_seterrno (ELF_E_INVALID_DATA);
+      return NULL;
+    }
+
   void *buf_out = malloc (size_out);
   if (unlikely (buf_out == NULL))
     {
diff --git a/src/ChangeLog b/src/ChangeLog
index 0601198c..e022503b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,33 @@
+2017-03-28  Mark Wielaard  <[email protected]>
+
+	* elflint (check_group): Don't check if there is no flag word.
+
+2017-03-27  Mark Wielaard  <[email protected]>
+
+	* elflint.c (check_elf_header): Sanity check phnum and shnum.
+
+2017-03-27  Mark Wielaard  <[email protected]>
+
+	* elflint.c (check_sysv_hash): Return early if section size is
+	too small.
+	(check_sysv_hash64): Likewise.
+	(check_hash): Calculate expect_entsize to check section size.
+
+2017-03-27  Mark Wielaard  <[email protected]>
+
+	* elflint.c (check_symtab_shndx): Check data->d_size.
+
+2017-03-24  Mark Wielaard  <[email protected]>
+
+	* elfcmp.c (main): If n_namesz == 0 then the note name data is the
+	empty string.
+	* readelf.c (handle_notes_data): Likewise.
+
+2017-03-24  Mark Wielaard  <[email protected]>
+
+	* readelf.c (handle_gnu_hash): Check inner < max_nsyms before
+	indexing into chain array.
+
 2017-02-16  Ulf Hermann  <[email protected]>
 
 	* addr2line.c: Include printversion.h
diff --git a/src/elfcmp.c b/src/elfcmp.c
index 7673cf21..50464207 100644
--- a/src/elfcmp.c
+++ b/src/elfcmp.c
@@ -419,7 +419,8 @@ main (int argc, char *argv[])
 		   && (off1 = gelf_getnote (data1, off1, &note1,
 					    &name_offset, &desc_offset)) > 0)
 	      {
-		const char *name1 = data1->d_buf + name_offset;
+		const char *name1 = (note1.n_namesz == 0
+				     ? "" : data1->d_buf + name_offset);
 		const void *desc1 = data1->d_buf + desc_offset;
 		if (off2 >= data2->d_size)
 		  {
@@ -435,7 +436,8 @@ main (int argc, char *argv[])
 		  error (2, 0, gettext ("\
 cannot read note section [%zu] '%s' in '%s': %s"),
 			 elf_ndxscn (scn2), sname2, fname2, elf_errmsg (-1));
-		const char *name2 = data2->d_buf + name_offset;
+		const char *name2 = (note2.n_namesz == 0
+				     ? "" : data2->d_buf + name_offset);
 		const void *desc2 = data2->d_buf + desc_offset;
 
 		if (note1.n_namesz != note2.n_namesz
diff --git a/src/elflint.c b/src/elflint.c
index 66a13ca2..e0c65b6a 100644
--- a/src/elflint.c
+++ b/src/elflint.c
@@ -1,5 +1,5 @@
 /* Pedantic checking of ELF files compliance with gABI/psABI spec.
-   Copyright (C) 2001-2015 Red Hat, Inc.
+   Copyright (C) 2001-2015, 2017 Red Hat, Inc.
    This file is part of elfutils.
    Written by Ulrich Drepper <[email protected]>, 2001.
 
@@ -456,6 +456,19 @@ invalid number of section header table entries\n"));
 	ERROR (gettext ("invalid section header index\n"));
     }
 
+  /* Check the shdrs actually exist. */
+  unsigned int scnt;
+  Elf_Scn *scn = NULL;
+  for (scnt = 1; scnt < shnum; ++scnt)
+     {
+	scn = elf_nextscn (ebl->elf, scn);
+	if (scn == NULL)
+	  break;
+     }
+  if (scnt < shnum)
+    ERROR (gettext ("Can only check %u headers, shnum was %u\n"), scnt, shnum);
+  shnum = scnt;
+
   phnum = ehdr->e_phnum;
   if (ehdr->e_phnum == PN_XNUM)
     {
@@ -474,6 +487,19 @@ invalid number of program header table entries\n"));
 	}
     }
 
+  /* Check the phdrs actually exist. */
+  unsigned int pcnt;
+  for (pcnt = 0; pcnt < phnum; ++pcnt)
+     {
+	GElf_Phdr phdr_mem;
+	GElf_Phdr *phdr = gelf_getphdr (ebl->elf, pcnt, &phdr_mem);
+	if (phdr == NULL)
+	  break;
+     }
+  if (pcnt < phnum)
+    ERROR (gettext ("Can only check %u headers, phnum was %u\n"), pcnt, phnum);
+  phnum = pcnt;
+
   /* Check the e_flags field.  */
   if (!ebl_machine_flag_check (ebl, ehdr->e_flags))
     ERROR (gettext ("invalid machine flags: %s\n"),
@@ -1959,7 +1985,8 @@ section [%2d] '%s': extended section index in section [%2zu] '%s' refers to same
       return;
     }
 
-  if (*((Elf32_Word *) data->d_buf) != 0)
+  if (data->d_size < sizeof (Elf32_Word)
+      || *((Elf32_Word *) data->d_buf) != 0)
     ERROR (gettext ("symbol 0 should have zero extended section index\n"));
 
   for (size_t cnt = 1; cnt < data->d_size / sizeof (Elf32_Word); ++cnt)
@@ -1992,11 +2019,14 @@ check_sysv_hash (Ebl *ebl, GElf_Shdr *shdr, Elf_Data *data, int idx,
   Elf32_Word nbucket = ((Elf32_Word *) data->d_buf)[0];
   Elf32_Word nchain = ((Elf32_Word *) data->d_buf)[1];
 
-  if (shdr->sh_size < (2 + nbucket + nchain) * shdr->sh_entsize)
-    ERROR (gettext ("\
+  if (shdr->sh_size < (2 + nbucket + nchain) * sizeof (Elf32_Word))
+    {
+      ERROR (gettext ("\
 section [%2d] '%s': hash table section is too small (is %ld, expected %ld)\n"),
-	   idx, section_name (ebl, idx), (long int) shdr->sh_size,
-	   (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
+	     idx, section_name (ebl, idx), (long int) shdr->sh_size,
+	     (long int) ((2 + nbucket + nchain) * sizeof (Elf32_Word)));
+      return;
+    }
 
   size_t maxidx = nchain;
 
@@ -2043,11 +2073,14 @@ check_sysv_hash64 (Ebl *ebl, GElf_Shdr *shdr, Elf_Data *data, int idx,
   Elf64_Xword nbucket = ((Elf64_Xword *) data->d_buf)[0];
   Elf64_Xword nchain = ((Elf64_Xword *) data->d_buf)[1];
 
-  if (shdr->sh_size < (2 + nbucket + nchain) * shdr->sh_entsize)
-    ERROR (gettext ("\
+  if (shdr->sh_size < (2 + nbucket + nchain) * sizeof (Elf64_Xword))
+    {
+      ERROR (gettext ("\
 section [%2d] '%s': hash table section is too small (is %ld, expected %ld)\n"),
-	   idx, section_name (ebl, idx), (long int) shdr->sh_size,
-	   (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
+	     idx, section_name (ebl, idx), (long int) shdr->sh_size,
+	     (long int) ((2 + nbucket + nchain) * sizeof (Elf64_Xword)));
+      return;
+    }
 
   size_t maxidx = nchain;
 
@@ -2287,10 +2320,12 @@ section [%2d] '%s': hash table not for dynamic symbol table\n"),
 section [%2d] '%s': invalid sh_link symbol table section index [%2d]\n"),
 	   idx, section_name (ebl, idx), shdr->sh_link);
 
-  if (shdr->sh_entsize != (tag == SHT_GNU_HASH
+  size_t expect_entsize = (tag == SHT_GNU_HASH
 			   ? (gelf_getclass (ebl->elf) == ELFCLASS32
 			      ? sizeof (Elf32_Word) : 0)
-			   : (size_t) ebl_sysvhash_entrysize (ebl)))
+			   : (size_t) ebl_sysvhash_entrysize (ebl));
+
+  if (shdr->sh_entsize != expect_entsize)
     ERROR (gettext ("\
 section [%2d] '%s': hash table entry size incorrect\n"),
 	   idx, section_name (ebl, idx));
@@ -2299,7 +2334,7 @@ section [%2d] '%s': hash table entry size incorrect\n"),
     ERROR (gettext ("section [%2d] '%s': not marked to be allocated\n"),
 	   idx, section_name (ebl, idx));
 
-  if (shdr->sh_size < (tag == SHT_GNU_HASH ? 4 : 2) * (shdr->sh_entsize ?: 4))
+  if (shdr->sh_size < (tag == SHT_GNU_HASH ? 4 : 2) * (expect_entsize ?: 4))
     {
       ERROR (gettext ("\
 section [%2d] '%s': hash table has not even room for initial administrative entries\n"),
@@ -2646,9 +2681,12 @@ section [%2d] '%s': section size not multiple of sizeof(Elf32_Word)\n"),
 	       idx, section_name (ebl, idx));
 
       if (data->d_size < elsize)
-	ERROR (gettext ("\
+	{
+	  ERROR (gettext ("\
 section [%2d] '%s': section group without flags word\n"),
 	       idx, section_name (ebl, idx));
+	  return;
+	}
       else if (be_strict)
 	{
 	  if (data->d_size < 2 * elsize)
diff --git a/src/readelf.c b/src/readelf.c
index 8d96ba3f..97a43b06 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -3263,7 +3263,7 @@ handle_gnu_hash (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr, size_t shstrndx)
 	    ++nsyms;
 	    if (maxlength < ++lengths[cnt])
 	      ++maxlength;
-	    if (inner > max_nsyms)
+	    if (inner >= max_nsyms)
 	      goto invalid_data;
 	  }
 	while ((chain[inner++] & 1) == 0);
@@ -9365,7 +9365,7 @@ handle_notes_data (Ebl *ebl, const GElf_Ehdr *ehdr,
 	 && (offset = gelf_getnote (data, offset,
 				    &nhdr, &name_offset, &desc_offset)) > 0)
     {
-      const char *name = data->d_buf + name_offset;
+      const char *name = nhdr.n_namesz == 0 ? "" : data->d_buf + name_offset;
       const char *desc = data->d_buf + desc_offset;
 
       char buf[100];
diff --git a/tests/ChangeLog b/tests/ChangeLog
index e6656c75..0df0bae4 100644
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,3 +1,10 @@
+2017-03-27  Mark Wielaard  <[email protected]>
+
+	* fillfile.c: New file.
+	* Makefile.am (check_PROGRAMS): Add fillfile.
+	(TESTS): Likewise.
+	(fillfile_LDADD): New variable.
+
 2017-02-15  Mark Wielaard  <[email protected]>
 
 	* Makefile.am (EXTRA_DIST): Add testfileppc64attrs.o.bz2.
diff --git a/tests/Makefile.am b/tests/Makefile.am
index a27e8687..f287d92b 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -53,7 +53,8 @@ check_PROGRAMS = arextract arsymtest newfile saridx scnnames sectiondump \
 		  buildid deleted deleted-lib.so aggregate_size vdsosyms \
 		  getsrc_die strptr newdata elfstrtab dwfl-proc-attach \
 		  elfshphehdr elfstrmerge dwelfgnucompressed elfgetchdr \
-		  elfgetzdata elfputzdata zstrptr emptyfile vendorelf
+		  elfgetzdata elfputzdata zstrptr emptyfile vendorelf \
+		  fillfile
 
 asm_TESTS = asm-tst1 asm-tst2 asm-tst3 asm-tst4 asm-tst5 \
 	    asm-tst6 asm-tst7 asm-tst8 asm-tst9
@@ -127,7 +128,7 @@ TESTS = run-arextract.sh run-arsymtest.sh newfile test-nlist \
 	run-elfgetzdata.sh run-elfputzdata.sh run-zstrptr.sh \
 	run-compress-test.sh \
 	run-readelf-zdebug.sh run-readelf-zdebug-rel.sh \
-	emptyfile vendorelf
+	emptyfile vendorelf fillfile
 
 if !BIARCH
 export ELFUTILS_DISABLE_BIARCH = 1
@@ -489,6 +490,7 @@ elfputzdata_LDADD = $(libelf)
 zstrptr_LDADD = $(libelf)
 emptyfile_LDADD = $(libelf)
 vendorelf_LDADD = $(libelf)
+fillfile_LDADD = $(libelf)
 
 # We want to test the libelf header against the system elf.h header.
 # Don't include any -I CPPFLAGS.
diff --git a/tests/fillfile.c b/tests/fillfile.c
new file mode 100644
index 00000000..915e249d
--- /dev/null
+++ b/tests/fillfile.c
@@ -0,0 +1,448 @@
+/* Test program for changing data in one section (but not others) with gaps.
+   Copyright (C) 2017 Red Hat, Inc.
+   This file is part of elfutils.
+
+   This file is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   elfutils is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <errno.h>
+#include <fcntl.h>
+#include <inttypes.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include ELFUTILS_HEADER(elf)
+#include <gelf.h>
+
+
+/* Index of last string added.  Returned by add_string ().  */
+static size_t stridx = 0;
+
+/* Adds a string and returns the offset in the section.  */
+static size_t
+add_strtab_entry (Elf_Scn *strtab, const char *str)
+{
+  size_t lastidx = stridx;
+  size_t size = strlen (str) + 1;
+
+  Elf_Data *data = elf_newdata (strtab);
+  if (data == NULL)
+    {
+      printf ("cannot create data SHSTRTAB section: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  data->d_buf = (char *) str; /* Discards const, but we will not change. */
+  data->d_type = ELF_T_BYTE;
+  data->d_size = size;
+  data->d_align = 1;
+  data->d_version = EV_CURRENT;
+
+  stridx += size;
+  printf ("add_string: '%s', stridx: %zd, lastidx: %zd\n",
+	  str, stridx, lastidx);
+  return lastidx;
+}
+
+static Elf_Scn *
+create_strtab (Elf *elf)
+{
+  // Create strtab section.
+  Elf_Scn *scn = elf_newscn (elf);
+  if (scn == NULL)
+    {
+      printf ("cannot create strings section: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  // Add an empty string to the table as NUL entry for section zero.
+  add_strtab_entry (scn, "");
+
+  GElf_Shdr shdr_mem;
+  GElf_Shdr *shdr = gelf_getshdr (scn, &shdr_mem);
+  if (shdr == NULL)
+    {
+      printf ("cannot get header for new strtab section: %s\n",
+	      elf_errmsg (-1));
+      exit (1);
+    }
+
+  shdr->sh_type = SHT_STRTAB;
+  shdr->sh_flags = 0;
+  shdr->sh_addr = 0;
+  shdr->sh_link = SHN_UNDEF;
+  shdr->sh_info = SHN_UNDEF;
+  shdr->sh_addralign = 1;
+  shdr->sh_entsize = 0;
+  shdr->sh_name = add_strtab_entry (scn, ".strtab");
+
+  // We have to store the section strtab index in the ELF header.
+  // So sections have actual names.
+  GElf_Ehdr ehdr_mem;
+  GElf_Ehdr *ehdr = gelf_getehdr (elf, &ehdr_mem);
+  if (ehdr == NULL)
+    {
+      printf ("cannot get ELF header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  int ndx = elf_ndxscn (scn);
+  ehdr->e_shstrndx = ndx;
+
+  if (gelf_update_ehdr (elf, ehdr) == 0)
+    {
+      printf ("cannot update ELF header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  // Finished strtab section, update the header.
+  if (gelf_update_shdr (scn, shdr) == 0)
+    {
+      printf ("cannot update STRTAB section header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  return scn;
+}
+
+static char sec_data[] = { 1, 2, 3, 4, 5 };
+static char new_data[] = { 5, 4, 3, 2, 1 };
+
+static void
+add_data_section (Elf *elf, Elf_Scn *strtab, const char *sname)
+{
+  printf ("Add data section %s\n", sname);
+  Elf_Scn *scn = elf_newscn (elf);
+  if (scn == NULL)
+    {
+      printf ("cannot create strings section: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  GElf_Shdr shdr_mem;
+  GElf_Shdr *shdr = gelf_getshdr (scn, &shdr_mem);
+  if (shdr == NULL)
+    {
+      printf ("cannot get header for new %s section: %s\n",
+	      sname, elf_errmsg (-1));
+      exit (1);
+    }
+
+  shdr->sh_type = SHT_PROGBITS;
+  shdr->sh_flags = 0;
+  shdr->sh_addr = 0;
+  shdr->sh_link = SHN_UNDEF;
+  shdr->sh_info = SHN_UNDEF;
+  shdr->sh_addralign = 128;  // Large alignment to force gap between sections.
+  shdr->sh_entsize = 1;
+  shdr->sh_name = add_strtab_entry (strtab, sname);
+
+  if (gelf_update_shdr (scn, shdr) == 0)
+    {
+      printf ("cannot update %s section header: %s\n", sname, elf_errmsg (-1));
+      exit (1);
+    }
+
+  /* Add some data, but less than alignment. */
+  Elf_Data *data = elf_newdata (scn);
+  if (data == NULL)
+    {
+      printf ("cannot update %s section header: %s\n", sname, elf_errmsg (-1));
+      exit (1);
+    }
+  data->d_buf = sec_data;
+  data->d_size = 5;
+}
+
+static void
+check_data (const char *sname, Elf_Data *data, char *buf)
+{
+  printf ("check data %s [", sname);
+  for (int i = 0; i < 5; i++)
+    printf ("%d%s", buf[i], i < 4 ? "," : "");
+  printf ("]\n");
+  if (data == NULL || data->d_buf == NULL)
+    {
+      printf ("No data in section %s\n", sname);
+      exit (1);
+    }
+
+  if (data->d_size != 5 || memcmp (data->d_buf, buf, 5) != 0)
+    {
+      printf ("Wrong data in section %s [", sname);
+      for (size_t i = 0; i < data->d_size; i++)
+	printf ("%d%s", ((char *)data->d_buf)[i],
+		i < data->d_size - 1 ? "," : "");
+      printf ("]\n");
+      exit(1);
+    }
+}
+
+static void
+check_elf (const char *fname, int class, int use_mmap)
+{
+  printf ("\nfname: %s\n", fname);
+  stridx = 0; // Reset strtab strings index
+
+  int fd = open (fname, O_RDWR | O_CREAT | O_TRUNC, 0666);
+  if (fd == -1)
+    {
+      printf ("cannot open `%s': %s\n", fname, strerror (errno));
+      exit (1);
+    }
+
+  Elf *elf = elf_begin (fd, use_mmap ? ELF_C_WRITE_MMAP : ELF_C_WRITE, NULL);
+  if (elf == NULL)
+    {
+      printf ("cannot create ELF descriptor: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  // Create an ELF header.
+  if (gelf_newehdr (elf, class) == 0)
+    {
+      printf ("cannot create ELF header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  GElf_Ehdr ehdr_mem;
+  GElf_Ehdr *ehdr = gelf_getehdr (elf, &ehdr_mem);
+  if (ehdr == NULL)
+    {
+      printf ("cannot get ELF header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  // Initialize header.
+  ehdr->e_ident[EI_DATA] = class == ELFCLASS64 ? ELFDATA2LSB : ELFDATA2MSB;
+  ehdr->e_ident[EI_OSABI] = ELFOSABI_GNU;
+  ehdr->e_type = ET_NONE;
+  ehdr->e_machine = EM_X86_64;
+  ehdr->e_version = EV_CURRENT;
+
+  if (gelf_update_ehdr (elf, ehdr) == 0)
+    {
+      printf ("cannot update ELF header: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  Elf_Scn *strtab = create_strtab (elf);
+  add_data_section (elf, strtab, ".data1");
+  add_data_section (elf, strtab, ".data2");
+  add_data_section (elf, strtab, ".data3");
+  add_data_section (elf, strtab, ".data4");
+
+  // Write everything to disk.
+  if (elf_update (elf, ELF_C_WRITE) < 0)
+    {
+      printf ("failure in elf_update(WRITE): %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  if (elf_end (elf) != 0)
+    {
+      printf ("failure in elf_end: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  close (fd);
+
+  /* Reread the ELF from disk now.  */
+  printf ("Rereading %s\n", fname);
+  fd = open (fname, O_RDWR, 0666);
+  if (fd == -1)
+    {
+      printf ("cannot (re)open `%s': %s\n", fname, strerror (errno));
+      exit (1);
+    }
+
+  elf = elf_begin (fd, use_mmap ? ELF_C_RDWR_MMAP : ELF_C_RDWR, NULL);
+  if (elf == NULL)
+    {
+      printf ("cannot create ELF descriptor read-only: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  /* We are going to change some data (in-place), but want the layout
+     to stay exactly the same. */
+  elf_flagelf (elf, ELF_C_SET, ELF_F_LAYOUT);
+
+  size_t shdrstrndx;
+  if (elf_getshdrstrndx (elf, &shdrstrndx) != 0)
+    {
+      printf ("cannot get shdr str ndx\n");
+      exit (1);
+    }
+  printf ("shdrstrndx: %zd\n", shdrstrndx);
+
+  // Get third data section and change it.
+  Elf_Scn *checkscn = NULL;
+  Elf_Scn *scn = elf_nextscn (elf, NULL);
+  while (scn != NULL)
+    {
+      GElf_Shdr shdr_mem;
+      GElf_Shdr *shdr = gelf_getshdr (scn, &shdr_mem);
+      if (shdr == NULL)
+	{
+	  printf ("cannot get header for section: %s\n", elf_errmsg (-1));
+	  exit (1);
+	}
+      const char *sname = elf_strptr (elf, shdrstrndx, shdr->sh_name);
+      if (sname != NULL && strcmp (".data3", sname) == 0)
+	checkscn = scn;
+
+      // Get all data, but don't really use it
+      // (this triggered the original bug).
+      Elf_Data *data = elf_getdata (scn, NULL);
+      if (data != NULL && data->d_buf != NULL && data->d_size == 0)
+	{
+	  printf ("Bad data...n");
+	  exit (1);
+	}
+      scn = elf_nextscn (elf, scn);
+    }
+
+  if (checkscn == NULL)
+    {
+      printf ("ELF file doesn't have a .data3 section\n");
+      exit (1);
+    }
+
+  Elf_Data *data = elf_getdata (checkscn, NULL);
+  check_data (".data3", data, sec_data);
+  memcpy (data->d_buf, new_data, 5);
+  elf_flagdata (data, ELF_C_SET, ELF_F_DIRTY);
+
+  // Write everything to disk.
+  if (elf_update (elf, ELF_C_WRITE) < 0)
+    {
+      printf ("failure in elf_update(WRITE): %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  if (elf_end (elf) != 0)
+    {
+      printf ("failure in elf_end: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  close (fd);
+
+  // And read it in one last time.
+  printf ("Rereading %s again\n", fname);
+  fd = open (fname, O_RDONLY, 0666);
+  if (fd == -1)
+    {
+      printf ("cannot open `%s' read-only: %s\n", fname, strerror (errno));
+      exit (1);
+    }
+
+  elf = elf_begin (fd, use_mmap ? ELF_C_READ_MMAP : ELF_C_READ, NULL);
+  if (elf == NULL)
+    {
+      printf ("cannot create ELF descriptor read-only: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  // Get all .data sections and check them.
+  Elf_Scn *scn1 = NULL;
+  Elf_Scn *scn2 = NULL;
+  Elf_Scn *scn3 = NULL;
+  Elf_Scn *scn4 = NULL;
+  scn = elf_nextscn (elf, NULL);
+  while (scn != NULL)
+    {
+      GElf_Shdr shdr_mem;
+      GElf_Shdr *shdr = gelf_getshdr (scn, &shdr_mem);
+      if (shdr == NULL)
+	{
+	  printf ("cannot get header for section: %s\n", elf_errmsg (-1));
+	  exit (1);
+	}
+      const char *sname = elf_strptr (elf, shdrstrndx, shdr->sh_name);
+      if (sname != NULL && strcmp (".data1", sname) == 0)
+	scn1 = scn;
+      else if (sname != NULL && strcmp (".data2", sname) == 0)
+	scn2 = scn;
+      else if (sname != NULL && strcmp (".data3", sname) == 0)
+	scn3 = scn;
+      else if (sname != NULL && strcmp (".data4", sname) == 0)
+	scn4 = scn;
+      scn = elf_nextscn (elf, scn);
+    }
+
+  if (scn1 == NULL)
+    {
+      printf ("ELF file doesn't have a .data1 section\n");
+      exit (1);
+    }
+  data = elf_getdata (scn1, NULL);
+  check_data (".data1", data, sec_data);
+
+  if (scn2 == NULL)
+    {
+      printf ("ELF file doesn't have a .data2 section\n");
+      exit (1);
+    }
+  data = elf_getdata (scn2, NULL);
+  check_data (".data2", data, sec_data);
+
+  if (scn3 == NULL)
+    {
+      printf ("ELF file doesn't have a .data3 section\n");
+      exit (1);
+    }
+  data = elf_getdata (scn3, NULL);
+  check_data (".data3", data, new_data);
+
+  if (scn4 == NULL)
+    {
+      printf ("ELF file doesn't have a .data4 section\n");
+      exit (1);
+    }
+  data = elf_getdata (scn4, NULL);
+  check_data (".data4", data, sec_data);
+
+  if (elf_end (elf) != 0)
+    {
+      printf ("failure in elf_end: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  close (fd);
+
+  unlink (fname);
+}
+
+int
+main (int argc __attribute__ ((unused)),
+      char *argv[] __attribute__ ((unused)))
+{
+  elf_version (EV_CURRENT);
+
+  elf_fill (0xA);
+
+  check_elf ("fill.elf.32", ELFCLASS32, 0);
+  check_elf ("fill.elf.32.mmap", ELFCLASS32, 1);
+  check_elf ("fill.elf.64", ELFCLASS64, 0);
+  check_elf ("fill.elf.64.mmap", ELFCLASS64, 1);
+
+  return 0;
+}