--- old/usr/src/cmd/dis/dis_target.c	2013-08-09 16:25:48.651616031 -0400
+++ new/usr/src/cmd/dis/dis_target.c	2013-08-09 16:25:48.662992064 -0400
@@ -446,6 +446,7 @@
 	current = tgt;
 	cmd = ELF_C_READ;
 	while ((elf = elf_begin(tgt->dt_fd, cmd, tgt->dt_elf_root)) != NULL) {
+		size_t shnum = 0;
 
 		if (elf_kind(tgt->dt_elf_root) == ELF_K_AR &&
 		    (arhdr = elf_getarhdr(elf)) == NULL) {
@@ -501,9 +502,16 @@
 			return (NULL);
 		}
 
+		if (elf_getshdrnum(elf, &shnum) == -1) {
+			warn("%s: failed to get number of sections in file",
+			    file);
+			dis_tgt_destroy(tgt);
+			return (NULL);
+		}
+
 		current->dt_shnmap = safe_malloc(sizeof (dis_shnmap_t) *
-		    ehdr.e_shnum);
-		current->dt_shncount = ehdr.e_shnum;
+		    shnum);
+		current->dt_shncount = shnum;
 
 		idx = 0;
 		dis_tgt_section_iter(current, tgt_scn_init, &idx);
--- old/usr/src/cmd/sgs/ar/common/ar.msg	2013-08-09 16:25:49.110914138 -0400
+++ new/usr/src/cmd/sgs/ar/common/ar.msg	2013-08-09 16:25:49.121627534 -0400
@@ -70,6 +70,8 @@
 @ MSG_ELF_GETSCN_FILE	"ar: %s has no section header or bad elf format: %s\n"
 @ MSG_ELF_GETSCN_AR	"ar: %s(%s) has no section header or bad elf \
 			 format: %s\n"
+@ MSG_ELF_GETSHDRSTRNDX_FILE "ar: %s has no string table index: %s\n"
+@ MSG_ELF_GETSHDRSTRNDX_AR "ar: %s(%s) has no string table index: %s\n"
 @ MSG_ELF_MALARCHIVE	"ar: %s: offset %lld: malformed archive: %s\n"
 @ MSG_ELF_RAWFILE	"ar: elf_rawfile() failed: %s\n"
 @ MSG_ELF_VERSION	"ar: libelf.a out of date: %s\n"
--- old/usr/src/cmd/sgs/ar/common/file.c	2013-08-09 16:25:49.474839725 -0400
+++ new/usr/src/cmd/sgs/ar/common/file.c	2013-08-09 16:25:49.485811932 -0400
@@ -205,6 +205,7 @@
 {
 	size_t		extent;
 	size_t		padding;
+	size_t		shnum;
 	GElf_Ehdr	ehdr;
 
 
@@ -222,8 +223,11 @@
 	 * we've found the end, and the difference is padding (We assume
 	 * that no ELF section can fit into PADSZ bytes).
 	 */
+	if (elf_getshdrnum(elf, &shnum) == -1)
+		return;
+
 	extent = gelf_getehdr(elf, &ehdr)
-	    ? (ehdr.e_shoff + (ehdr.e_shnum * ehdr.e_shentsize)) : 0;
+	    ? (ehdr.e_shoff + (shnum * ehdr.e_shentsize)) : 0;
 
 	/*
 	 * If the extent exceeds the end of the archive member
@@ -552,11 +556,33 @@
 			exit(1);
 		}
 		if (gelf_getehdr(elf, &ehdr) != 0) {
+			size_t shstrndx = 0;
 			if ((class = gelf_getclass(elf)) == ELFCLASS64) {
 				fptr->ar_flag |= F_CLASS64;
 			} else if (class == ELFCLASS32)
 				fptr->ar_flag |= F_CLASS32;
-			scn = elf_getscn(elf, ehdr.e_shstrndx);
+
+			if (elf_getshdrstrndx(elf, &shstrndx) == -1) {
+				if (fptr->ar_pathname != NULL) {
+					(void) fprintf(stderr,
+					    MSG_INTL(MSG_ELF_GETSHDRSTRNDX_FILE),
+					    fptr->ar_pathname, elf_errmsg(-1));
+				} else {
+					(void) fprintf(stderr,
+					    MSG_INTL(MSG_ELF_GETSHDRSTRNDX_AR),
+					    arname, fptr->ar_longname,
+					    elf_errmsg(-1));
+				}
+				num_errs++;
+				if (newfd) {
+					(void) close(newfd);
+					newfd = 0;
+				}
+				(void) elf_end(elf);
+				continue;
+			}
+
+			scn = elf_getscn(elf, shstrndx);
 			if (scn == NULL) {
 				if (fptr->ar_pathname != NULL)
 					(void) fprintf(stderr,
@@ -640,7 +666,7 @@
 					continue;
 				}
 				*found_obj = 1;
-				if (shdr.sh_type == SHT_SYMTAB)
+				if (shdr.sh_type == SHT_SYMTAB) {
 					if (search_sym_tab(arname, fptr, elf,
 					    scn, &nsyms, symlist,
 					    &num_errs) == -1) {
@@ -650,6 +676,7 @@
 						}
 						continue;
 					}
+				}
 			}
 		}
 		mem_offset += sizeof (struct ar_hdr) + fptr->ar_size;
--- old/usr/src/cmd/sgs/libld/common/syms.c	2013-08-09 16:25:49.966769790 -0400
+++ new/usr/src/cmd/sgs/libld/common/syms.c	2013-08-09 16:25:49.978160813 -0400
@@ -2053,7 +2053,7 @@
 				shndx = symshndx[ndx];
 			} else if ((shndx = sym->st_shndx) >= SHN_LORESERVE) {
 				sdflags |= FLG_SY_SPECSEC;
-			} else if (shndx > ifl->ifl_ehdr->e_shnum) {
+			} else if (shndx > ifl->ifl_shnum) {
 				/* We need the name before we can issue error */
 				shndx_bad = 1;
 			}
@@ -2368,7 +2368,7 @@
 			shndx = symshndx[ndx];
 		} else if ((shndx = nsym->st_shndx) >= SHN_LORESERVE) {
 			sdflags |= FLG_SY_SPECSEC;
-		} else if (shndx > ifl->ifl_ehdr->e_shnum) {
+		} else if (shndx > ifl->ifl_shnum) {
 			/* We need the name before we can issue error */
 			shndx_bad = 1;
 		}
--- old/usr/src/cmd/sgs/librtld/common/dldump.c	2013-08-09 16:25:50.540337560 -0400
+++ new/usr/src/cmd/sgs/librtld/common/dldump.c	2013-08-09 16:25:50.551009373 -0400
@@ -25,7 +25,6 @@
  *
  * dldump(3c) creates a new file image from the specified input file.
  */
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
 
 #include	<sys/param.h>
 #include	<sys/procfs.h>
@@ -158,7 +157,7 @@
 	Elf_Data	*data;
 	Half		endx = 1;
 	int		fd = 0, err, num;
-	size_t		shstr_size = 1;
+	size_t		shstr_size = 1, shndx;
 	Addr		edata;
 	char		*shstr, *_shstr, *ipath = NAME(lmp);
 	prstatus_t	*status = 0, _status;
@@ -309,7 +308,13 @@
 	/*
 	 * Obtain the input files section header string table.
 	 */
-	if ((scn = elf_getscn(ielf, iehdr->e_shstrndx)) == NULL) {
+
+	if (elf_getshdrstrndx(ielf, &shndx) == -1) {
+		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSHDRSTRNDX), ipath);
+		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
+		return (1);
+	}
+	if ((scn = elf_getscn(ielf, shndx)) == NULL) {
 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSCN), ipath);
 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
 		return (1);
@@ -327,7 +332,15 @@
 	 * add an additional entry (marked FLG_C_END) to make the processing of
 	 * this cache easier.
 	 */
-	num = iehdr->e_shnum;
+
+	if (elf_getshdrnum(ielf, &shndx) == -1) {
+		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSHDRNUM), opath);
+		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
+		return (1);
+	}
+
+	num = shndx;
+
 	if (status)
 		num++;
 	if ((icache = malloc((num + 1) * sizeof (Cache))) == 0) {
@@ -420,7 +433,7 @@
 			if (status) {
 				_icache++;
 				_icache->c_name =
-					(char *)MSG_ORIG(MSG_SCN_HEAP);
+				    (char *)MSG_ORIG(MSG_SCN_HEAP);
 				_icache->c_flags = FLG_C_HEAP;
 
 				_icache->c_scn = 0;
@@ -624,7 +637,27 @@
 			_icache->c_info = shstr;
 
 			/* LINTED */
-			oehdr->e_shstrndx = (Half)elf_ndxscn(scn);
+			if (elf_ndxscn(scn) >= SHN_LORESERVE) {
+				Elf_Scn	*_scn;
+				Shdr	*shdr0;
+
+				/*
+				 * libelf deals with e_shnum for us, but we
+				 * need to deal with e_shstrndx ourselves.
+				 */
+				oehdr->e_shstrndx = SHN_XINDEX;
+				if ((_scn = elf_getscn(oelf, 0)) == NULL) {
+					eprintf(lml, ERR_ELF,
+					    MSG_ORIG(MSG_ELF_GETSCN), opath);
+					cleanup(ielf, oelf, melf, icache,
+					    mcache, fd, opath);
+					return (1);
+				}
+				shdr0 = elf_getshdr(_scn);
+				shdr0->sh_link = elf_ndxscn(scn);
+			} else {
+				oehdr->e_shstrndx = (Half)elf_ndxscn(scn);
+			}
 
 		} else if (_icache->c_flags == FLG_C_HEAP) {
 			/*
@@ -727,10 +760,16 @@
 		return (1);
 	}
 
+	if (elf_getshdrnum(melf, &shndx) == -1) {
+		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSHDRNUM), opath);
+		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
+		return (1);
+	}
+
 	/*
 	 * Construct a cache to maintain the memory files section information.
 	 */
-	if ((mcache = malloc(mehdr->e_shnum * sizeof (Cache))) == 0) {
+	if ((mcache = malloc(shndx * sizeof (Cache))) == 0) {
 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
 		return (1);
 	}
--- old/usr/src/cmd/sgs/librtld/common/librtld.msg	2013-08-09 16:25:50.962311863 -0400
+++ new/usr/src/cmd/sgs/librtld/common/librtld.msg	2013-08-09 16:25:50.973283192 -0400
@@ -70,6 +70,8 @@
 @ MSG_ELF_GETPHDR	"%s: elf_getphdr"
 @ MSG_ELF_GETSCN	"%s: elf_getscn"
 @ MSG_ELF_GETSHDR	"%s: elf_getshdr"
+@ MSG_ELF_GETSHDRNUM	"%s: elf_getshdrnum"
+@ MSG_ELF_GETSHDRSTRNDX	"%s: elf_getshdrstrndx"
 @ MSG_ELF_NEWDATA	"%s: elf_newdata"
 @ MSG_ELF_NEWEHDR	"%s: elf_newehdr"
 @ MSG_ELF_NEWPHDR	"%s: elf_newphdr"
--- old/usr/src/cmd/sgs/packages/common/SUNWonld-README	2013-08-09 16:25:51.329488126 -0400
+++ new/usr/src/cmd/sgs/packages/common/SUNWonld-README	2013-08-09 16:25:51.341862385 -0400
@@ -1648,3 +1648,5 @@
 3709	need sloppy relocation for GNU .debug_macro
 3722	link-editor is over restrictive of R_AMD64_32 addends
 3926	multiple extern map file definitions corrupt symbol table entry
+3999	libld extended section handling is broken
+4003	dldump() can't deal with extended sections
--- old/usr/src/cmd/sgs/pvs/common/pvs.c	2013-08-09 16:25:51.823087143 -0400
+++ new/usr/src/cmd/sgs/pvs/common/pvs.c	2013-08-09 16:25:51.835163736 -0400
@@ -1090,6 +1090,7 @@
 	for (; optind < argc; optind++) {
 		int		derror = 0, nerror = 0,	err;
 		const char	*file = argv[optind];
+		size_t		shnum = 0;
 
 		if ((var = open(file, O_RDONLY)) == -1) {
 			err = errno;
@@ -1154,7 +1155,13 @@
 		 * as elf_begin has already gone through all the overhead we
 		 * might as well set up the cache for every section.
 		 */
-		if ((cache = calloc(ehdr.e_shnum, sizeof (Cache))) == NULL) {
+		if (elf_getshdrnum(elf, &shnum) == -1) {
+			(void) fprintf(stderr, MSG_ORIG(MSG_ELF_GETSHDRNUM),
+			    cname, file, elf_errmsg(elf_errno()));
+			exit(1);
+		}
+
+		if ((cache = calloc(shnum, sizeof (Cache))) == NULL) {
 			int err = errno;
 			(void) fprintf(stderr, MSG_INTL(MSG_SYS_MALLOC), cname,
 			    file, strerror(err));
--- old/usr/src/cmd/sgs/pvs/common/pvs.msg	2013-08-09 16:25:52.281043602 -0400
+++ new/usr/src/cmd/sgs/pvs/common/pvs.msg	2013-08-09 16:25:52.291728260 -0400
@@ -77,6 +77,7 @@
 @ MSG_ELF_GETSCN	"%s: %s: elf_getscn: %s\n"
 @ MSG_ELF_GETSHDR	"%s: %s: elf_getshdr: %s\n"
 @ MSG_ELF_GETDATA	"%s: %s: elf_getdata: %s\n"
+@ MSG_ELF_GETSHDRNUM	"%s: %s: elf_getshdrnum: %s\n"
 
 @ MSG_STR_EMPTY		""
 @ MSG_STR_OPTIONS	"CdI:lnorsvN:"
--- old/usr/src/cmd/sgs/size/common/process.c	2013-08-09 16:25:52.660146156 -0400
+++ new/usr/src/cmd/sgs/size/common/process.c	2013-08-09 16:25:52.670967230 -0400
@@ -22,7 +22,7 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-   
+
 /*	Copyright (c) 1988 AT&T	*/
 /*	Copyright (c) 1989 AT&T	*/
 /*	  All Rights Reserved  	*/
@@ -68,9 +68,9 @@
 process(Elf * elf)
 {
 	/* EXTERNAL VARIABLES USED */
-	extern int	fflag, /* full format for sections */
-			Fflag, /* full format for segments */
-			nflag; /* include non-loadable segments or sections */
+	extern int	fflag; /* full format for sections */
+	extern int	Fflag; /* full format for segments */
+	extern int	nflag; /* include non-loadable segments or sections */
 	extern int	numbase; /* hex, octal, or decimal */
 	extern char	*fname;
 	extern char	*archive;
@@ -78,24 +78,25 @@
 	extern int	oneflag;
 
 	/* LOCAL VARIABLES */
-	GElf_Xword	size, /* total size in non-default case for sections */
-			/*
-			 * size of first, second, third number and total size
-			 * in default case for sections.
-			 */
-			first,
-			second,
-			third,
-			totsize;
+	GElf_Xword	size; /* total size in non-default case for sections */
+	/*
+	 * size of first, second, third number and total size
+	 * in default case for sections.
+	 */
+	GElf_Xword	first;
+	GElf_Xword	second;
+	GElf_Xword	third;
+	GElf_Xword	totsize;
 	GElf_Ehdr	ehdr;
 	GElf_Shdr	shdr;
 	Elf_Scn		*scn;
-	unsigned	ndx = 0;
+	size_t		ndx = 0, shnum = 0;
 	int		numsect = 0;
 	int		notfirst = 0;
 	int		i;
 	char		*name = 0;
 
+
 /*
  * If there is a program header and the -f flag requesting section infor-
  * mation is not set, then process segments with the process_phdr function.
@@ -124,14 +125,19 @@
 	} else if (!oneflag && !is_archive) {
 		(void) printf("%s: ", fname);
 	}
-	ndx = ehdr.e_shstrndx;
+	if (elf_getshdrstrndx(elf, &ndx) == -1)
+		error(fname, "no string table");
 	scn = 0;
 	size = 0;
 	first = second = third = totsize = 0;
-	if (ehdr.e_shnum == 0) {
+
+	if (elf_getshdrnum(elf, &shnum) == -1)
+		error(fname, "can't get number of sections");
+
+	if (shnum == 0)
 		error(fname, "no section data");
-	}
-	numsect = ehdr.e_shnum;
+
+	numsect = shnum;
 	for (i = 0; i < numsect; i++) {
 		if ((scn = elf_nextscn(elf, scn)) == 0) {
 			break;
@@ -144,23 +150,23 @@
 			error(fname, "no segment data");
 			return;
 		} else if ((!(shdr.sh_flags & SHF_ALLOC)) &&
-			fflag && !(nflag)) {
+		    fflag && !(nflag)) {
 			continue;
 		} else if ((!(shdr.sh_flags & SHF_ALLOC)) && !(nflag)) {
 			continue;
 		} else if ((shdr.sh_flags & SHF_ALLOC) &&
-			(!(shdr.sh_flags & SHF_WRITE)) &&
-			(!(shdr.sh_type == SHT_NOBITS)) &&
-			!(fflag) && !(nflag)) {
+		    (!(shdr.sh_flags & SHF_WRITE)) &&
+		    (!(shdr.sh_type == SHT_NOBITS)) &&
+		    !(fflag) && !(nflag)) {
 			first += shdr.sh_size;
 		} else if ((shdr.sh_flags & SHF_ALLOC) &&
-			(shdr.sh_flags & SHF_WRITE) &&
-			(!(shdr.sh_type == SHT_NOBITS)) &&
-			!(fflag) && !(nflag)) {
+		    (shdr.sh_flags & SHF_WRITE) &&
+		    (!(shdr.sh_type == SHT_NOBITS)) &&
+		    !(fflag) && !(nflag)) {
 			second += shdr.sh_size;
 		} else if ((shdr.sh_flags & SHF_WRITE) &&
-			(shdr.sh_type == SHT_NOBITS) &&
-			!(fflag) && !(nflag)) {
+		    (shdr.sh_type == SHT_NOBITS) &&
+		    !(fflag) && !(nflag)) {
 			third += shdr.sh_size;
 		}
 		name = elf_strptr(elf, ndx, (size_t)shdr.sh_name);
@@ -182,7 +188,7 @@
 	if (!fflag && !nflag) {
 		totsize = first + second + third;
 		(void) printf(format[numbase],
-			first, second, third, totsize);
+		    first, second, third, totsize);
 	}
 
 	if (Fflag) {
@@ -215,19 +221,19 @@
 	int		i;
 	int		notfirst = 0;
 	GElf_Phdr	p;
-	GElf_Xword	memsize,
-			total,
-			First,
-			Second,
-			Third,
-			Totsize;
-		extern int Fflag;
-		extern int nflag;
-		extern int numbase;
-		extern char *fname;
-		extern char *archive;
-		extern int is_archive;
-		extern int oneflag;
+	GElf_Xword	memsize;
+	GElf_Xword	total;
+	GElf_Xword	First;
+	GElf_Xword	Second;
+	GElf_Xword	Third;
+	GElf_Xword	Totsize;
+	extern int Fflag;
+	extern int nflag;
+	extern int numbase;
+	extern char *fname;
+	extern char *archive;
+	extern int is_archive;
+	extern int oneflag;
 
 	memsize = total = 0;
 	First = Second = Third = Totsize = 0;
@@ -301,6 +307,6 @@
 	if (!Fflag && !nflag) {
 		Totsize = First + Second + (Third - Second);
 		(void) printf(format[numbase],
-			First, Second, Third - Second, Totsize);
+		    First, Second, Third - Second, Totsize);
 	}
 }
--- old/usr/src/lib/libctf/common/ctf_lib.c	2013-08-09 16:25:53.383821536 -0400
+++ new/usr/src/lib/libctf/common/ctf_lib.c	2013-08-09 16:25:53.394409687 -0400
@@ -193,6 +193,7 @@
 {
 	ctf_sect_t ctfsect, symsect, strsect;
 	ctf_file_t *fp = NULL;
+	size_t shstrndx, shnum;
 
 	struct stat64 st;
 	ssize_t nbytes;
@@ -255,11 +256,10 @@
 #else
 		uchar_t order = ELFDATA2LSB;
 #endif
-		GElf_Half i, n;
 		GElf_Shdr *sp;
 
 		void *strs_map;
-		size_t strs_mapsz;
+		size_t strs_mapsz, i;
 		const char *strs;
 
 		if (hdr.e32.e_ident[EI_DATA] != order)
@@ -275,11 +275,38 @@
 			ehdr_to_gelf(&e32, &hdr.e64);
 		}
 
-		if (hdr.e64.e_shstrndx >= hdr.e64.e_shnum)
+		shnum = hdr.e64.e_shnum;
+		shstrndx = hdr.e64.e_shstrndx;
+
+		/* Extended ELF sections */
+		if ((shstrndx == SHN_XINDEX) || (shnum == 0)) {
+			if (hdr.e32.e_ident[EI_CLASS] == ELFCLASS32) {
+				Elf32_Shdr x32;
+
+				if (pread64(fd, &x32, sizeof (x32),
+				    hdr.e64.e_shoff) != sizeof (x32))
+					return (ctf_set_open_errno(errp,
+					    errno));
+
+				shnum = x32.sh_size;
+				shstrndx = x32.sh_link;
+			} else {
+				Elf64_Shdr x64;
+
+				if (pread64(fd, &x64, sizeof (x64),
+				    hdr.e64.e_shoff) != sizeof (x64))
+					return (ctf_set_open_errno(errp,
+					    errno));
+
+				shnum = x64.sh_size;
+				shstrndx = x64.sh_link;
+			}
+		}
+
+		if (shstrndx >= shnum)
 			return (ctf_set_open_errno(errp, ECTF_CORRUPT));
 
-		n = hdr.e64.e_shnum;
-		nbytes = sizeof (GElf_Shdr) * n;
+		nbytes = sizeof (GElf_Shdr) * shnum;
 
 		if ((sp = malloc(nbytes)) == NULL)
 			return (ctf_set_open_errno(errp, errno));
@@ -291,7 +318,7 @@
 		if (hdr.e32.e_ident[EI_CLASS] == ELFCLASS32) {
 			Elf32_Shdr *sp32;
 
-			nbytes = sizeof (Elf32_Shdr) * n;
+			nbytes = sizeof (Elf32_Shdr) * shnum;
 
 			if ((sp32 = malloc(nbytes)) == NULL || pread64(fd,
 			    sp32, nbytes, hdr.e64.e_shoff) != nbytes) {
@@ -299,7 +326,7 @@
 				return (ctf_set_open_errno(errp, errno));
 			}
 
-			for (i = 0; i < n; i++)
+			for (i = 0; i < shnum; i++)
 				shdr_to_gelf(&sp32[i], &sp[i]);
 
 			free(sp32);
@@ -313,14 +340,14 @@
 		 * Now mmap the section header strings section so that we can
 		 * perform string comparison on the section names.
 		 */
-		strs_mapsz = sp[hdr.e64.e_shstrndx].sh_size +
-		    (sp[hdr.e64.e_shstrndx].sh_offset & ~_PAGEMASK);
+		strs_mapsz = sp[shstrndx].sh_size +
+		    (sp[shstrndx].sh_offset & ~_PAGEMASK);
 
 		strs_map = mmap64(NULL, strs_mapsz, PROT_READ, MAP_PRIVATE,
-		    fd, sp[hdr.e64.e_shstrndx].sh_offset & _PAGEMASK);
+		    fd, sp[shstrndx].sh_offset & _PAGEMASK);
 
 		strs = (const char *)strs_map +
-		    (sp[hdr.e64.e_shstrndx].sh_offset & ~_PAGEMASK);
+		    (sp[shstrndx].sh_offset & ~_PAGEMASK);
 
 		if (strs_map == MAP_FAILED) {
 			free(sp);
@@ -331,15 +358,15 @@
 		 * Iterate over the section header array looking for the CTF
 		 * section and symbol table.  The strtab is linked to symtab.
 		 */
-		for (i = 0; i < n; i++) {
+		for (i = 0; i < shnum; i++) {
 			const GElf_Shdr *shp = &sp[i];
 			const GElf_Shdr *lhp = &sp[shp->sh_link];
 
-			if (shp->sh_link >= hdr.e64.e_shnum)
+			if (shp->sh_link >= shnum)
 				continue; /* corrupt sh_link field */
 
-			if (shp->sh_name >= sp[hdr.e64.e_shstrndx].sh_size ||
-			    lhp->sh_name >= sp[hdr.e64.e_shstrndx].sh_size)
+			if (shp->sh_name >= sp[shstrndx].sh_size ||
+			    lhp->sh_name >= sp[shstrndx].sh_size)
 				continue; /* corrupt sh_name field */
 
 			if (shp->sh_type == SHT_PROGBITS &&
