Buffer-Overflow triggered by supplying a malformed file, causing String position index to exceed the length

[kirit1193]

A Buffer-Overflow can be triggered by supplying a malformed ELF file in the command:

./patchelf --shrink-rpath %file%

The relevant Address Sanitizer output is:

./src/patchelf --shrink-rpath src/crashes/patchelf015000016
ASAN:DEADLYSIGNAL
=================================================================
==29540==ERROR: AddressSanitizer: SEGV on unknown address 0x7f1bc00fcd70 (pc 0x000000515bf0 bp 0x7ffd8f3b7d30 sp 0x7ffd8f3b7be0 T0)
==29540==The signal is caused by a READ memory access.
    #0 0x515bef in splitColonDelimitedString[abi:cxx11](char const*) /tmp/ramdisk/patchelf/src/patchelf.cc:62:12
    #1 0x55c14e in ElfFile<Elf64_Ehdr, Elf64_Phdr, Elf64_Shdr, unsigned long, unsigned long, Elf64_Dyn, Elf64_Sym, Elf64_Verneed>::modifyRPath(ElfFile<Elf64_Ehdr, Elf64_Phdr, Elf64_Shdr, unsigned long, unsigned long, Elf64_Dyn, Elf64_Sym, Elf64_Verneed>::RPathOp, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) /tmp/ramdisk/patchelf/src/patchelf.cc:1173:31
    #2 0x50d1e3 in void patchElf2<ElfFile<Elf64_Ehdr, Elf64_Phdr, Elf64_Shdr, unsigned long, unsigned long, Elf64_Dyn, Elf64_Sym, Elf64_Verneed> >(ElfFile<Elf64_Ehdr, Elf64_Phdr, Elf64_Shdr, unsigned long, unsigned long, Elf64_Dyn, Elf64_Sym, Elf64_Verneed>&&) /tmp/ramdisk/patchelf/src/patchelf.cc:1567:17
    #3 0x50d1e3 in patchElf() /tmp/ramdisk/patchelf/src/patchelf.cc:1601
    #4 0x50d1e3 in mainWrapped(int, char**) /tmp/ramdisk/patchelf/src/patchelf.cc:1730
    #5 0x51670a in main /tmp/ramdisk/patchelf/src/patchelf.cc:1738:16
    #6 0x7f1bbb9853f0 in __libc_start_main /build/glibc-mXZSwJ/glibc-2.24/csu/../csu/libc-start.c:291
    #7 0x41d9b9 in _start (/tmp/ramdisk/patchelf/src/patchelf+0x41d9b9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/ramdisk/patchelf/src/patchelf.cc:62:12 in splitColonDelimitedString[abi:cxx11](char const*)
==29540==ABORTING

This seems to be getting triggered by the pos index variable going out of bounds in the block:

while (*pos) {
        const char * end = strchr(pos, ':');
        if (!end) end = strchr(pos, 0);

        parts.push_back(std::string(pos, end - pos));
        if (*end == ':') ++end;
        pos = end;
    }

The file causing this scenario is attached:
patchelf-pos.zip