--- /dev/null
+--- file-4.07/src/readelf.c.orig 2003-11-18 20:42:33.000000000 +0100
++++ file-4.07/src/readelf.c 2004-03-19 22:54:46.236372725 +0100
+@@ -147,6 +147,9 @@
+ getu32(swap, ph32.p_align) : 4) \
+ : (off_t) (ph64.p_align ? \
+ getu64(swap, ph64.p_align) : 4)))
++#define ph_filesz (class == ELFCLASS32 \
++ ? getu32(swap, ph32.p_filesz) \
++ : getu64(swap, ph64.p_filesz))
+ #define nh_size (class == ELFCLASS32 \
+ ? sizeof nh32 \
+ : sizeof nh64)
+@@ -249,7 +252,7 @@
+ file_badseek(ms);
+ return -1;
+ }
+- bufsize = read(fd, nbuf, BUFSIZ);
++ bufsize = read(fd, nbuf, ((ph_filesz < BUFSIZ) ? ph_filesz : BUFSIZ));
+ if (bufsize == -1) {
+ file_badread(ms);
+ return -1;
+@@ -297,7 +297,7 @@
+ noff = offset;
+ doff = ELF_ALIGN(offset + nh_namesz);
+
+- if (offset + nh_namesz >= size) {
++ if (doff > size) {
+ /*
+ * We're past the end of the buffer.
+ */
+@@ -305,7 +305,7 @@
+ }
+
+ offset = ELF_ALIGN(doff + nh_descsz);
+- if (offset + nh_descsz >= size)
++ if (offset > size)
+ return offset;
+
+ if (nh_namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
+@@ -622,7 +625,8 @@
+ file_badseek(ms);
+ return -1;
+ }
+- bufsize = read(fd, nbuf, sizeof(nbuf));
++ bufsize = read(fd, nbuf,
++ ((ph_filesz < sizeof(nbuf)) ? ph_filesz : sizeof(nbuf)));
+ if (bufsize == -1) {
+ file_badread(ms);
+ return -1;
+@@ -634,7 +638,7 @@
+ offset = donote(ms, nbuf, offset,
+ (size_t)bufsize, class, swap, ph_align);
+ }
+- if (lseek(fd, savedoffset + offset, SEEK_SET)
++ if (lseek(fd, savedoffset, SEEK_SET)
+ == (off_t)-1) {
+ file_badseek(ms);
+ return -1;