I found some bugs in readelf code, up to version 4.09 of file, all
related to PT_NOTE analysis. I made some changes, which seems to work
fine (especially on 64-bit Linux platforms, where file used to abort on
some Elf64 files).
List of problems and changes (in the included patch) follows:
- it tried to always read sizeof(nbuf) (8kB or so) even when NOTE
section size was smaller; and then it tried to parse (well, almost,
see below) whole data read to buffer (less than sizeof(nbuf) only
in case of EOF).
I added reading section size from p_filesz field and using it to
limit the number of bytes to read and parse afterwards.
- dophn_exec() used wrong offset to restore file position PT_NOTE
analysis; it should be just savedoffset, not savedoffset+offset
(offset is the size of parsed data from NOTE, not program header).
- there were wrong conditions when checking note header offset, not
allowing to parse whole buffer passed to donote().
(detected when after applying the first change)