Fix two pointer arithmetic errors.

courgette/disassembler_elf_32_x86.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "courgette/disassembler_elf_32_x86.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 549 matching lines @@
   // Find the rel32 relocations.
   const uint8* p = start_pointer;
   while (p < end_pointer) {
     //RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
 
     // Heuristic discovery of rel32 locations in instruction stream: are the
     // next few bytes the start of an instruction containing a rel32
     // addressing mode?
     const uint8* rel32 = NULL;
 
-    if (p + 5 < end_pointer) {
+    if (p + 5 <= end_pointer) {
       if (*p == 0xE8 || *p == 0xE9) {  // jmp rel32 and call rel32
         rel32 = p + 1;
       }
     }
-    if (p + 6 < end_pointer) {
+    if (p + 6 <= end_pointer) {
       if (*p == 0x0F  &&  (*(p+1) & 0xF0) == 0x80) {  // Jcc long form
         if (p[1] != 0x8A && p[1] != 0x8B)  // JPE/JPO unlikely
           rel32 = p + 2;
       }
     }
     if (rel32) {
       RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
 
       RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
       // To be valid, rel32 target must be within image, and within this
       // section.
       if (IsValidRVA(target_rva)) {
         rel32_locations_.push_back(rel32_rva);
 #if COURGETTE_HISTOGRAM_TARGETS
         ++rel32_target_rvas_[target_rva];
 #endif
-        p += 4;
+        p = rel32 + 4;
         continue;
       }
     }
     p += 1;
   }
 
   return true;
 }
 
 }  // namespace courgette