2 2005-06-09 Roland McGrath <roland@redhat.com>
4 * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
5 (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
6 (handle_scngrp): Check for bogus sh_info.
8 * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
9 st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
10 Don't use assert on input values, instead bail with "illformed" error.
12 2005-05-17 Jakub Jelinek <jakub@redhat.com>
15 * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
16 table fits into object's bounds.
17 * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
18 elf->map_address. Check if first section header fits into object's
20 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)):
21 Check if section header table fits into object's bounds.
22 * elf_begin.c (get_shnum): Ensure section headers fits into
24 (file_read_elf): Make sure scncnt is small enough to allocate both
25 ElfXX_Shdr and Elf_Scn array. Make sure section and program header
26 tables fit into object's bounds. Avoid memory leak on failure.
29 * elflint.c (check_hash): Don't check entries beyond end of section.
30 (check_note): Don't crash if gelf_rawchunk fails.
31 (section_name): Return <invalid> if gelf_getshdr returns NULL.
33 2005-05-14 Jakub Jelinek <jakub@redhat.com>
36 * libelfP.h (INVALID_NDX): Define.
37 * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
38 * gelf_getlib.c (gelf_getlib): Likewise.
39 * gelf_getmove.c (gelf_getmove): Likewise.
40 * gelf_getrel.c (gelf_getrel): Likewise.
41 * gelf_getrela.c (gelf_getrela): Likewise.
42 * gelf_getsym.c (gelf_getsym): Likewise.
43 * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
44 * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
45 * gelf_getversym.c (gelf_getversym): Likewise.
46 * gelf_update_dyn.c (gelf_update_dyn): Likewise.
47 * gelf_update_lib.c (gelf_update_lib): Likewise.
48 * gelf_update_move.c (gelf_update_move): Likewise.
49 * gelf_update_rel.c (gelf_update_rel): Likewise.
50 * gelf_update_rela.c (gelf_update_rela): Likewise.
51 * gelf_update_sym.c (gelf_update_sym): Likewise.
52 * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
53 * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
54 * gelf_update_versym.c (gelf_update_versym): Likewise.
55 * elf_newscn.c (elf_newscn): Check for overflow.
56 * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
57 (__elfw2(LIBELFBITS,updatefile)): Likewise.
58 * elf_begin.c (file_read_elf): Likewise.
59 * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
60 * elf_getarsym.c (elf_getarsym): Likewise.
61 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
63 * elflint.c (section_name): Return "<invalid>" instead of
64 crashing on invalid section name.
65 (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
66 check_symtab_shndx, check_hash, check_versym): Robustify.
68 --- elfutils-0.136/libelf/elf32_getphdr.c.robustify
69 +++ elfutils-0.136/libelf/elf32_getphdr.c
70 @@ -105,6 +105,16 @@ __elfw2(LIBELFBITS,getphdr_wrlock) (elf)
72 if (elf->map_address != NULL)
74 + /* First see whether the information in the ELF header is
75 + valid and it does not ask for too much. */
76 + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
77 + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
79 + /* Something is wrong. */
80 + __libelf_seterrno (ELF_E_INVALID_PHDR);
84 /* All the data is already mapped. Use it. */
85 void *file_phdr = ((char *) elf->map_address
86 + elf->start_offset + ehdr->e_phoff);
87 --- elfutils-0.136/libelf/elf32_getshdr.c.robustify
88 +++ elfutils-0.136/libelf/elf32_getshdr.c
90 /* Return section header.
91 - Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005, 2007 Red Hat, Inc.
92 + Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005, 2007, 2008 Red Hat, Inc.
93 This file is part of Red Hat elfutils.
94 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
96 @@ -81,7 +81,8 @@ load_shdr_rwlock (Elf_Scn *scn)
100 - if (__elf_getshnum_rdlock (elf, &shnum) != 0)
101 + if (__elf_getshnum_rdlock (elf, &shnum) != 0
102 + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
104 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
106 @@ -98,6 +99,16 @@ load_shdr_rwlock (Elf_Scn *scn)
108 if (elf->map_address != NULL)
110 + /* First see whether the information in the ELF header is
111 + valid and it does not ask for too much. */
112 + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
113 + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
115 + /* Something is wrong. */
116 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
120 ElfW2(LIBELFBITS,Shdr) *notcvt;
122 /* All the data is already mapped. If we could use it
123 --- elfutils-0.136/libelf/elf32_newphdr.c.robustify
124 +++ elfutils-0.136/libelf/elf32_newphdr.c
125 @@ -124,6 +124,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count)
126 else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
127 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
129 + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
135 /* Allocate a new program header with the appropriate number of
137 result = (ElfW2(LIBELFBITS,Phdr) *)
138 --- elfutils-0.136/libelf/elf32_updatefile.c.robustify
139 +++ elfutils-0.136/libelf/elf32_updatefile.c
140 @@ -212,6 +212,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf
141 /* Write all the sections. Well, only those which are modified. */
144 + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
147 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
148 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
149 char *const shdr_start = ((char *) elf->map_address + elf->start_offset
150 @@ -582,6 +585,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf
151 /* Write all the sections. Well, only those which are modified. */
154 + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
155 + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
158 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
160 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
161 --- elfutils-0.136/libelf/elf_begin.c.robustify
162 +++ elfutils-0.136/libelf/elf_begin.c
163 @@ -155,7 +155,8 @@ get_shnum (void *map_address, unsigned c
165 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
167 - if (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
168 + if (unlikely (ehdr.e32->e_shoff >= maxsize)
169 + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
170 /* Cannot read the first section header. */
173 @@ -203,7 +204,8 @@ get_shnum (void *map_address, unsigned c
175 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
177 - if (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
178 + if (unlikely (ehdr.e64->e_shoff >= maxsize)
179 + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
180 /* Cannot read the first section header. */
183 @@ -275,6 +277,15 @@ file_read_elf (int fildes, void *map_add
184 /* Could not determine the number of sections. */
187 + /* Check for too many sections. */
188 + if (e_ident[EI_CLASS] == ELFCLASS32)
190 + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
193 + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
196 /* We can now allocate the memory. */
197 Elf *elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
198 ELF_K_ELF, scncnt * sizeof (Elf_Scn));
199 @@ -308,13 +319,31 @@ file_read_elf (int fildes, void *map_add
201 /* We can use the mmapped memory. */
202 elf->state.elf32.ehdr = ehdr;
204 + if (unlikely (ehdr->e_shoff >= maxsize)
205 + || unlikely (ehdr->e_shoff
206 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
210 + __libelf_seterrno (ELF_E_INVALID_FILE);
213 elf->state.elf32.shdr
214 = (Elf32_Shdr *) ((char *) ehdr + ehdr->e_shoff);
216 if (ehdr->e_phnum > 0)
218 /* Assign a value only if there really is a program
219 header. Otherwise the value remains NULL. */
220 + if (unlikely (ehdr->e_phoff >= maxsize)
221 + || unlikely (ehdr->e_phoff
223 + * sizeof (Elf32_Phdr) > maxsize))
225 elf->state.elf32.phdr
226 = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff);
229 for (size_t cnt = 0; cnt < scncnt; ++cnt)
231 @@ -396,13 +425,26 @@ file_read_elf (int fildes, void *map_add
233 /* We can use the mmapped memory. */
234 elf->state.elf64.ehdr = ehdr;
236 + if (unlikely (ehdr->e_shoff >= maxsize)
237 + || unlikely (ehdr->e_shoff
238 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
240 elf->state.elf64.shdr
241 = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff);
243 if (ehdr->e_phnum > 0)
245 /* Assign a value only if there really is a program
246 header. Otherwise the value remains NULL. */
247 + if (unlikely (ehdr->e_phoff >= maxsize)
248 + || unlikely (ehdr->e_phoff
250 + * sizeof (Elf32_Phdr) > maxsize))
252 elf->state.elf64.phdr
253 = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff);
256 for (size_t cnt = 0; cnt < scncnt; ++cnt)
258 --- elfutils-0.136/libelf/elf_getarsym.c.robustify
259 +++ elfutils-0.136/libelf/elf_getarsym.c
260 @@ -179,6 +179,9 @@ elf_getarsym (elf, ptr)
261 size_t index_size = atol (tmpbuf);
263 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
264 +#if SIZE_MAX <= 4294967295U
265 + || n >= SIZE_MAX / sizeof (Elf_Arsym)
267 || n * sizeof (uint32_t) > index_size)
269 /* This index table cannot be right since it does not fit into
270 --- elfutils-0.136/libelf/elf_getshstrndx.c.robustify
271 +++ elfutils-0.136/libelf/elf_getshstrndx.c
272 @@ -125,10 +125,25 @@ elf_getshstrndx (elf, dst)
273 if (elf->map_address != NULL
274 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
276 - || (((size_t) ((char *) elf->map_address + offset))
277 + || (((size_t) ((char *) elf->map_address
278 + + elf->start_offset + offset))
279 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
281 + /* First see whether the information in the ELF header is
282 + valid and it does not ask for too much. */
283 + if (unlikely (offset + sizeof (Elf32_Shdr)
284 + > elf->maximum_size))
286 + /* Something is wrong. */
287 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
292 /* We can directly access the memory. */
293 - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
294 + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
295 + + offset))->sh_link;
299 /* We avoid reading in all the section headers. Just read
300 @@ -163,10 +178,25 @@ elf_getshstrndx (elf, dst)
301 if (elf->map_address != NULL
302 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
304 - || (((size_t) ((char *) elf->map_address + offset))
305 + || (((size_t) ((char *) elf->map_address
306 + + elf->start_offset + offset))
307 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
309 + /* First see whether the information in the ELF header is
310 + valid and it does not ask for too much. */
311 + if (unlikely (offset + sizeof (Elf64_Shdr)
312 + > elf->maximum_size))
314 + /* Something is wrong. */
315 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
320 /* We can directly access the memory. */
321 - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
322 + num = ((Elf64_Shdr *) (elf->map_address
323 + + elf->start_offset + offset))->sh_link;
327 /* We avoid reading in all the section headers. Just read
328 --- elfutils-0.136/libelf/elf_newscn.c.robustify
329 +++ elfutils-0.136/libelf/elf_newscn.c
330 @@ -104,10 +104,18 @@ elf_newscn (elf)
333 /* We must allocate a new element. */
335 + Elf_ScnList *newp = NULL;
337 assert (elf->state.elf.scnincr > 0);
340 +#if SIZE_MAX <= 4294967295U
341 + likely (elf->state.elf.scnincr
342 + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
347 newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
348 + ((elf->state.elf.scnincr *= 2)
349 * sizeof (Elf_Scn)), 1);
350 --- elfutils-0.136/libelf/gelf_getdyn.c.robustify
351 +++ elfutils-0.136/libelf/gelf_getdyn.c
352 @@ -93,7 +93,8 @@ gelf_getdyn (data, ndx, dst)
353 table entries has to be adopted. The user better has provided
354 a buffer where we can store the information. While copying the
355 data we are converting the format. */
356 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
357 + if (INVALID_NDX (ndx, Elf32_Dyn)
358 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
360 __libelf_seterrno (ELF_E_INVALID_INDEX);
362 @@ -114,7 +115,8 @@ gelf_getdyn (data, ndx, dst)
364 /* The data is already in the correct form. Just make sure the
366 - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
367 + if (INVALID_NDX (ndx, GElf_Dyn)
368 + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
370 __libelf_seterrno (ELF_E_INVALID_INDEX);
372 --- elfutils-0.136/libelf/gelf_getlib.c.robustify
373 +++ elfutils-0.136/libelf/gelf_getlib.c
374 @@ -86,7 +86,8 @@ gelf_getlib (data, ndx, dst)
375 /* The data is already in the correct form. Just make sure the
377 GElf_Lib *result = NULL;
378 - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
379 + if (INVALID_NDX (ndx, GElf_Lib)
380 + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
381 __libelf_seterrno (ELF_E_INVALID_INDEX);
384 --- elfutils-0.136/libelf/gelf_getmove.c.robustify
385 +++ elfutils-0.136/libelf/gelf_getmove.c
386 @@ -83,7 +83,8 @@ gelf_getmove (data, ndx, dst)
388 /* The data is already in the correct form. Just make sure the
390 - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
391 + if (INVALID_NDX (ndx, GElf_Move)
392 + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
394 __libelf_seterrno (ELF_E_INVALID_INDEX);
396 --- elfutils-0.136/libelf/gelf_getrela.c.robustify
397 +++ elfutils-0.136/libelf/gelf_getrela.c
398 @@ -71,12 +71,6 @@ gelf_getrela (data, ndx, dst)
399 if (data_scn == NULL)
402 - if (unlikely (ndx < 0))
404 - __libelf_seterrno (ELF_E_INVALID_INDEX);
408 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
410 __libelf_seterrno (ELF_E_INVALID_HANDLE);
411 @@ -93,7 +87,8 @@ gelf_getrela (data, ndx, dst)
412 if (scn->elf->class == ELFCLASS32)
414 /* We have to convert the data. */
415 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
416 + if (INVALID_NDX (ndx, Elf32_Rela)
417 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
419 __libelf_seterrno (ELF_E_INVALID_INDEX);
421 @@ -114,7 +109,8 @@ gelf_getrela (data, ndx, dst)
423 /* Simply copy the data after we made sure we are actually getting
425 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
426 + if (INVALID_NDX (ndx, Elf64_Rela)
427 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
429 __libelf_seterrno (ELF_E_INVALID_INDEX);
431 --- elfutils-0.136/libelf/gelf_getrel.c.robustify
432 +++ elfutils-0.136/libelf/gelf_getrel.c
433 @@ -71,12 +71,6 @@ gelf_getrel (data, ndx, dst)
434 if (data_scn == NULL)
437 - if (unlikely (ndx < 0))
439 - __libelf_seterrno (ELF_E_INVALID_INDEX);
443 if (unlikely (data_scn->d.d_type != ELF_T_REL))
445 __libelf_seterrno (ELF_E_INVALID_HANDLE);
446 @@ -93,7 +87,8 @@ gelf_getrel (data, ndx, dst)
447 if (scn->elf->class == ELFCLASS32)
449 /* We have to convert the data. */
450 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
451 + if (INVALID_NDX (ndx, Elf32_Rel)
452 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
454 __libelf_seterrno (ELF_E_INVALID_INDEX);
456 @@ -113,7 +108,8 @@ gelf_getrel (data, ndx, dst)
458 /* Simply copy the data after we made sure we are actually getting
460 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
461 + if (INVALID_NDX (ndx, Elf64_Rel)
462 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
464 __libelf_seterrno (ELF_E_INVALID_INDEX);
466 --- elfutils-0.136/libelf/gelf_getsym.c.robustify
467 +++ elfutils-0.136/libelf/gelf_getsym.c
468 @@ -90,7 +90,8 @@ gelf_getsym (data, ndx, dst)
469 table entries has to be adopted. The user better has provided
470 a buffer where we can store the information. While copying the
471 data we are converting the format. */
472 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
473 + if (INVALID_NDX (ndx, Elf32_Sym)
474 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
476 __libelf_seterrno (ELF_E_INVALID_INDEX);
478 @@ -119,7 +120,8 @@ gelf_getsym (data, ndx, dst)
480 /* The data is already in the correct form. Just make sure the
482 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
483 + if (INVALID_NDX (ndx, GElf_Sym)
484 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
486 __libelf_seterrno (ELF_E_INVALID_INDEX);
488 --- elfutils-0.136/libelf/gelf_getsyminfo.c.robustify
489 +++ elfutils-0.136/libelf/gelf_getsyminfo.c
490 @@ -84,7 +84,8 @@ gelf_getsyminfo (data, ndx, dst)
492 /* The data is already in the correct form. Just make sure the
494 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
495 + if (INVALID_NDX (ndx, GElf_Syminfo)
496 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
498 __libelf_seterrno (ELF_E_INVALID_INDEX);
500 --- elfutils-0.136/libelf/gelf_getsymshndx.c.robustify
501 +++ elfutils-0.136/libelf/gelf_getsymshndx.c
502 @@ -90,7 +90,9 @@ gelf_getsymshndx (symdata, shndxdata, nd
503 section index table. */
504 if (likely (shndxdata_scn != NULL))
506 - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
507 + if (INVALID_NDX (ndx, Elf32_Word)
508 + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
509 + > shndxdata_scn->d.d_size))
511 __libelf_seterrno (ELF_E_INVALID_INDEX);
513 @@ -110,7 +112,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
514 table entries has to be adopted. The user better has provided
515 a buffer where we can store the information. While copying the
516 data we are converting the format. */
517 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
518 + if (INVALID_NDX (ndx, Elf32_Sym)
519 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
521 __libelf_seterrno (ELF_E_INVALID_INDEX);
523 @@ -139,7 +142,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
525 /* The data is already in the correct form. Just make sure the
527 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
528 + if (INVALID_NDX (ndx, GElf_Sym)
529 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
531 __libelf_seterrno (ELF_E_INVALID_INDEX);
533 --- elfutils-0.136/libelf/gelf_getversym.c.robustify
534 +++ elfutils-0.136/libelf/gelf_getversym.c
535 @@ -92,7 +92,8 @@ gelf_getversym (data, ndx, dst)
537 /* The data is already in the correct form. Just make sure the
539 - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
540 + if (INVALID_NDX (ndx, GElf_Versym)
541 + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
543 __libelf_seterrno (ELF_E_INVALID_INDEX);
545 --- elfutils-0.136/libelf/gelf_update_dyn.c.robustify
546 +++ elfutils-0.136/libelf/gelf_update_dyn.c
547 @@ -71,12 +71,6 @@ gelf_update_dyn (data, ndx, src)
551 - if (unlikely (ndx < 0))
553 - __libelf_seterrno (ELF_E_INVALID_INDEX);
557 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
559 /* The type of the data better should match. */
560 @@ -102,7 +96,8 @@ gelf_update_dyn (data, ndx, src)
563 /* Check whether we have to resize the data buffer. */
564 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
565 + if (INVALID_NDX (ndx, Elf32_Dyn)
566 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
568 __libelf_seterrno (ELF_E_INVALID_INDEX);
570 @@ -116,7 +111,8 @@ gelf_update_dyn (data, ndx, src)
573 /* Check whether we have to resize the data buffer. */
574 - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
575 + if (INVALID_NDX (ndx, Elf64_Dyn)
576 + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
578 __libelf_seterrno (ELF_E_INVALID_INDEX);
580 --- elfutils-0.136/libelf/gelf_update_lib.c.robustify
581 +++ elfutils-0.136/libelf/gelf_update_lib.c
582 @@ -68,12 +68,6 @@ gelf_update_lib (data, ndx, src)
586 - if (unlikely (ndx < 0))
588 - __libelf_seterrno (ELF_E_INVALID_INDEX);
592 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
593 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
595 @@ -87,7 +81,8 @@ gelf_update_lib (data, ndx, src)
597 /* Check whether we have to resize the data buffer. */
599 - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
600 + if (INVALID_NDX (ndx, Elf64_Lib)
601 + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
602 __libelf_seterrno (ELF_E_INVALID_INDEX);
605 --- elfutils-0.136/libelf/gelf_update_move.c.robustify
606 +++ elfutils-0.136/libelf/gelf_update_move.c
607 @@ -75,7 +75,7 @@ gelf_update_move (data, ndx, src)
608 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
610 /* Check whether we have to resize the data buffer. */
611 - if (unlikely (ndx < 0)
612 + if (INVALID_NDX (ndx, GElf_Move)
613 || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
615 __libelf_seterrno (ELF_E_INVALID_INDEX);
616 --- elfutils-0.136/libelf/gelf_update_rela.c.robustify
617 +++ elfutils-0.136/libelf/gelf_update_rela.c
618 @@ -68,12 +68,6 @@ gelf_update_rela (Elf_Data *dst, int ndx
622 - if (unlikely (ndx < 0))
624 - __libelf_seterrno (ELF_E_INVALID_INDEX);
628 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
630 /* The type of the data better should match. */
631 @@ -101,7 +95,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
634 /* Check whether we have to resize the data buffer. */
635 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
636 + if (INVALID_NDX (ndx, Elf32_Rela)
637 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
639 __libelf_seterrno (ELF_E_INVALID_INDEX);
641 @@ -117,7 +112,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
644 /* Check whether we have to resize the data buffer. */
645 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
646 + if (INVALID_NDX (ndx, Elf64_Rela)
647 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
649 __libelf_seterrno (ELF_E_INVALID_INDEX);
651 --- elfutils-0.136/libelf/gelf_update_rel.c.robustify
652 +++ elfutils-0.136/libelf/gelf_update_rel.c
653 @@ -68,12 +68,6 @@ gelf_update_rel (Elf_Data *dst, int ndx,
657 - if (unlikely (ndx < 0))
659 - __libelf_seterrno (ELF_E_INVALID_INDEX);
663 if (unlikely (data_scn->d.d_type != ELF_T_REL))
665 /* The type of the data better should match. */
666 @@ -99,7 +93,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
669 /* Check whether we have to resize the data buffer. */
670 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
671 + if (INVALID_NDX (ndx, Elf32_Rel)
672 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
674 __libelf_seterrno (ELF_E_INVALID_INDEX);
676 @@ -114,7 +109,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
679 /* Check whether we have to resize the data buffer. */
680 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
681 + if (INVALID_NDX (ndx, Elf64_Rel)
682 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
684 __libelf_seterrno (ELF_E_INVALID_INDEX);
686 --- elfutils-0.136/libelf/gelf_update_sym.c.robustify
687 +++ elfutils-0.136/libelf/gelf_update_sym.c
688 @@ -72,12 +72,6 @@ gelf_update_sym (data, ndx, src)
692 - if (unlikely (ndx < 0))
694 - __libelf_seterrno (ELF_E_INVALID_INDEX);
698 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
700 /* The type of the data better should match. */
701 @@ -102,7 +96,8 @@ gelf_update_sym (data, ndx, src)
704 /* Check whether we have to resize the data buffer. */
705 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
706 + if (INVALID_NDX (ndx, Elf32_Sym)
707 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
709 __libelf_seterrno (ELF_E_INVALID_INDEX);
711 @@ -125,7 +120,8 @@ gelf_update_sym (data, ndx, src)
714 /* Check whether we have to resize the data buffer. */
715 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
716 + if (INVALID_NDX (ndx, Elf64_Sym)
717 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
719 __libelf_seterrno (ELF_E_INVALID_INDEX);
721 --- elfutils-0.136/libelf/gelf_update_syminfo.c.robustify
722 +++ elfutils-0.136/libelf/gelf_update_syminfo.c
723 @@ -72,12 +72,6 @@ gelf_update_syminfo (data, ndx, src)
727 - if (unlikely (ndx < 0))
729 - __libelf_seterrno (ELF_E_INVALID_INDEX);
733 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
735 /* The type of the data better should match. */
736 @@ -93,7 +87,8 @@ gelf_update_syminfo (data, ndx, src)
737 rwlock_wrlock (scn->elf->lock);
739 /* Check whether we have to resize the data buffer. */
740 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
741 + if (INVALID_NDX (ndx, GElf_Syminfo)
742 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
744 __libelf_seterrno (ELF_E_INVALID_INDEX);
746 --- elfutils-0.136/libelf/gelf_update_symshndx.c.robustify
747 +++ elfutils-0.136/libelf/gelf_update_symshndx.c
748 @@ -77,12 +77,6 @@ gelf_update_symshndx (symdata, shndxdata
752 - if (unlikely (ndx < 0))
754 - __libelf_seterrno (ELF_E_INVALID_INDEX);
758 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
760 /* The type of the data better should match. */
761 @@ -128,7 +122,8 @@ gelf_update_symshndx (symdata, shndxdata
764 /* Check whether we have to resize the data buffer. */
765 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
766 + if (INVALID_NDX (ndx, Elf32_Sym)
767 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
769 __libelf_seterrno (ELF_E_INVALID_INDEX);
771 @@ -151,7 +146,8 @@ gelf_update_symshndx (symdata, shndxdata
774 /* Check whether we have to resize the data buffer. */
775 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
776 + if (INVALID_NDX (ndx, Elf64_Sym)
777 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
779 __libelf_seterrno (ELF_E_INVALID_INDEX);
781 --- elfutils-0.136/libelf/gelf_update_versym.c.robustify
782 +++ elfutils-0.136/libelf/gelf_update_versym.c
783 @@ -75,7 +75,7 @@ gelf_update_versym (data, ndx, src)
784 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
786 /* Check whether we have to resize the data buffer. */
787 - if (unlikely (ndx < 0)
788 + if (INVALID_NDX (ndx, GElf_Versym)
789 || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
791 __libelf_seterrno (ELF_E_INVALID_INDEX);
792 --- elfutils-0.136/libelf/libelfP.h.robustify
793 +++ elfutils-0.136/libelf/libelfP.h
794 @@ -611,4 +611,13 @@ extern uint32_t __libelf_crc32 (uint32_t
795 /* Align offset to 4 bytes as needed for note name and descriptor data. */
796 #define NOTE_ALIGN(n) (((n) + 3) & -4U)
798 +/* Convenience macro. Assumes int NDX and TYPE with size at least
800 +#if SIZE_MAX > 4294967295U
801 +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
803 +# define INVALID_NDX(ndx, type) \
804 + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
807 #endif /* libelfP.h */
808 --- elfutils-0.136/src/elflint.c.robustify
809 +++ elfutils-0.136/src/elflint.c
810 @@ -131,6 +131,9 @@ static uint32_t shstrndx;
811 /* Array to count references in section groups. */
814 +/* Number of sections. */
815 +static unsigned int shnum;
819 main (int argc, char *argv[])
820 @@ -320,10 +323,19 @@ section_name (Ebl *ebl, int idx)
826 + if ((unsigned int) idx > shnum)
827 + return "<invalid>";
829 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
831 + return "<invalid>";
833 - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
834 + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
836 + return "<invalid>";
841 @@ -345,10 +357,6 @@ static const int valid_e_machine[] =
842 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
845 -/* Number of sections. */
846 -static unsigned int shnum;
850 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
852 @@ -613,7 +621,8 @@ section [%2d] '%s': symbol table cannot
856 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
857 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
858 + if (shdr->sh_entsize != sh_entsize)
860 section [%2u] '%s': entry size is does not match ElfXX_Sym\n"),
861 idx, section_name (ebl, idx));
862 @@ -651,7 +660,7 @@ section [%2d] '%s': XINDEX for zeroth en
863 xndxscnidx, section_name (ebl, xndxscnidx));
866 - for (size_t cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
867 + for (size_t cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
869 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
871 @@ -671,7 +680,8 @@ section [%2d] '%s': symbol %zu: invalid
874 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
875 - assert (name != NULL);
876 + assert (name != NULL
877 + || strshdr->sh_type != SHT_STRTAB);
880 if (sym->st_shndx == SHN_XINDEX)
881 @@ -1001,9 +1011,11 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e
883 GElf_Shdr rcshdr_mem;
884 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
885 - assert (rcshdr != NULL);
887 - if (rcshdr->sh_type == SHT_DYNAMIC)
888 + if (rcshdr == NULL)
891 + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
893 /* Found the dynamic section. Look through it. */
894 Elf_Data *d = elf_getdata (scn, NULL);
895 @@ -1013,7 +1025,9 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e
898 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
899 - assert (dyn != NULL);
904 if (dyn->d_tag == DT_RELCOUNT)
906 @@ -1027,7 +1041,9 @@ section [%2d] '%s': DT_RELCOUNT used for
907 /* Does the number specified number of relative
908 relocations exceed the total number of
910 - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
911 + if (shdr->sh_entsize != 0
912 + && dyn->d_un.d_val > (shdr->sh_size
913 + / shdr->sh_entsize))
915 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
916 idx, section_name (ebl, idx),
917 @@ -1187,7 +1203,8 @@ section [%2d] '%s': no relocations for m
921 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT))
922 + size_t sh_entsize = gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT);
923 + if (shdr->sh_entsize != sh_entsize)
924 ERROR (gettext (reltype == ELF_T_RELA ? "\
925 section [%2d] '%s': section entry size does not match ElfXX_Rela\n" : "\
926 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
927 @@ -1410,7 +1427,8 @@ check_rela (Ebl *ebl, GElf_Ehdr *ehdr, G
928 Elf_Data *symdata = elf_getdata (symscn, NULL);
929 enum load_state state = state_undecided;
931 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
932 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
933 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
936 GElf_Rela *rela = gelf_getrela (data, cnt, &rela_mem);
937 @@ -1460,7 +1478,8 @@ check_rel (Ebl *ebl, GElf_Ehdr *ehdr, GE
938 Elf_Data *symdata = elf_getdata (symscn, NULL);
939 enum load_state state = state_undecided;
941 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
942 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
943 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
946 GElf_Rel *rel = gelf_getrel (data, cnt, &rel_mem);
947 @@ -1563,7 +1582,8 @@ section [%2d] '%s': referenced as string
948 shdr->sh_link, section_name (ebl, shdr->sh_link),
949 idx, section_name (ebl, idx));
951 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
952 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
953 + if (shdr->sh_entsize != sh_entsize)
955 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
956 idx, section_name (ebl, idx));
957 @@ -1573,7 +1593,7 @@ section [%2d] '%s': section entry size d
958 idx, section_name (ebl, idx));
960 bool non_null_warned = false;
961 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
962 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
965 GElf_Dyn *dyn = gelf_getdyn (data, cnt, &dyn_mem);
966 @@ -1854,6 +1874,8 @@ section [%2d] '%s': entry size does not
967 idx, section_name (ebl, idx));
970 + && shdr->sh_entsize
971 + && symshdr->sh_entsize
972 && (shdr->sh_size / shdr->sh_entsize
973 < symshdr->sh_size / symshdr->sh_entsize))
975 @@ -1880,6 +1902,12 @@ section [%2d] '%s': extended section ind
978 Elf_Data *data = elf_getdata (elf_getscn (ebl->elf, idx), NULL);
981 + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
982 + idx, section_name (ebl, idx));
986 if (*((Elf32_Word *) data->d_buf) != 0)
987 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
988 @@ -1922,7 +1950,7 @@ section [%2d] '%s': hash table section i
990 size_t maxidx = nchain;
992 - if (symshdr != NULL)
993 + if (symshdr != NULL && symshdr->sh_entsize != 0)
995 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
997 @@ -1933,18 +1961,28 @@ section [%2d] '%s': hash table section i
1001 + Elf32_Word *buf = (Elf32_Word *) data->d_buf;
1002 + Elf32_Word *end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
1004 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1005 - if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
1007 + if (buf + cnt >= end)
1009 + else if (buf[cnt] >= maxidx)
1011 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1012 idx, section_name (ebl, idx), cnt - 2);
1015 for (; cnt < 2 + nbucket + nchain; ++cnt)
1016 - if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
1018 + if (buf + cnt >= end)
1020 + else if (buf[cnt] >= maxidx)
1022 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
1023 idx, section_name (ebl, idx), cnt - 2 - nbucket);
1028 @@ -1974,18 +2012,28 @@ section [%2d] '%s': hash table section i
1032 + Elf64_Xword *buf = (Elf64_Xword *) data->d_buf;
1033 + Elf64_Xword *end = (Elf64_Xword *) ((char *) data->d_buf + shdr->sh_size);
1035 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1036 - if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
1038 + if (buf + cnt >= end)
1040 + else if (buf[cnt] >= maxidx)
1042 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1043 idx, section_name (ebl, idx), cnt - 2);
1046 for (; cnt < 2 + nbucket + nchain; ++cnt)
1047 - if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
1049 + if (buf + cnt >= end)
1051 + else if (buf[cnt] >= maxidx)
1053 section [%2d] '%s': hash chain reference %" PRIu64 " out of bounds\n"),
1054 - idx, section_name (ebl, idx), (uint64_t) (cnt - 2 - nbucket));
1055 + idx, section_name (ebl, idx), (uint64_t) cnt - 2 - nbucket);
1060 @@ -2010,7 +2058,7 @@ section [%2d] '%s': bitmask size not pow
1061 if (shdr->sh_size < (4 + bitmask_words + nbuckets) * sizeof (Elf32_Word))
1064 -section [%2d] '%s': hash table section is too small (is %ld, expected at least%ld)\n"),
1065 +section [%2d] '%s': hash table section is too small (is %ld, expected at least %ld)\n"),
1066 idx, section_name (ebl, idx), (long int) shdr->sh_size,
1067 (long int) ((4 + bitmask_words + nbuckets) * sizeof (Elf32_Word)));
1069 @@ -2682,8 +2730,9 @@ section [%2d] '%s' refers in sh_link to
1071 /* The number of elements in the version symbol table must be the
1072 same as the number of symbols. */
1073 - if (shdr->sh_size / shdr->sh_entsize
1074 - != symshdr->sh_size / symshdr->sh_entsize)
1075 + if (shdr->sh_entsize && symshdr->sh_entsize
1076 + && (shdr->sh_size / shdr->sh_entsize
1077 + != symshdr->sh_size / symshdr->sh_entsize))
1079 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
1080 idx, section_name (ebl, idx),
1081 --- elfutils-0.136/src/readelf.c.robustify
1082 +++ elfutils-0.136/src/readelf.c
1083 @@ -1111,6 +1111,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
1084 Elf32_Word *grpref = (Elf32_Word *) data->d_buf;
1087 + GElf_Sym *sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
1089 printf ((grpref[0] & GRP_COMDAT)
1091 \nCOMDAT section group [%2zu] '%s' with signature '%s' contains %zu entry:\n",
1092 @@ -1123,8 +1125,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
1093 data->d_size / sizeof (Elf32_Word) - 1),
1095 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
1096 - elf_strptr (ebl->elf, symshdr->sh_link,
1097 - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
1098 + (sym == NULL ? NULL
1099 + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
1100 ?: gettext ("<INVALID SYMBOL>"),
1101 data->d_size / sizeof (Elf32_Word) - 1);
1103 @@ -1275,7 +1277,8 @@ static void
1104 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
1106 int class = gelf_getclass (ebl->elf);
1108 + GElf_Shdr glink_mem;
1113 @@ -1290,6 +1293,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
1114 error (EXIT_FAILURE, 0,
1115 gettext ("cannot get section header string table index"));
1117 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1118 + if (glink == NULL)
1119 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1120 + elf_ndxscn (scn));
1122 printf (ngettext ("\
1123 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1125 @@ -1299,9 +1307,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
1126 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1128 (int) shdr->sh_link,
1129 - elf_strptr (ebl->elf, shstrndx,
1130 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1131 - &glink)->sh_name));
1132 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1133 fputs_unlocked (gettext (" Type Value\n"), stdout);
1135 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1136 @@ -1801,6 +1807,13 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
1137 error (EXIT_FAILURE, 0,
1138 gettext ("cannot get section header string table index"));
1140 + GElf_Shdr glink_mem;
1141 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1143 + if (glink == NULL)
1144 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1145 + elf_ndxscn (scn));
1147 /* Now we can compute the number of entries in the section. */
1148 unsigned int nsyms = data->d_size / (class == ELFCLASS32
1149 ? sizeof (Elf32_Sym)
1150 @@ -1811,15 +1824,12 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
1152 (unsigned int) elf_ndxscn (scn),
1153 elf_strptr (ebl->elf, shstrndx, shdr->sh_name), nsyms);
1155 printf (ngettext (" %lu local symbol String table: [%2u] '%s'\n",
1156 " %lu local symbols String table: [%2u] '%s'\n",
1158 (unsigned long int) shdr->sh_info,
1159 (unsigned int) shdr->sh_link,
1160 - elf_strptr (ebl->elf, shstrndx,
1161 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1162 - &glink)->sh_name));
1163 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1165 fputs_unlocked (class == ELFCLASS32
1167 @@ -2055,7 +2065,13 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
1168 error (EXIT_FAILURE, 0,
1169 gettext ("cannot get section header string table index"));
1172 + GElf_Shdr glink_mem;
1173 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1175 + if (glink == NULL)
1176 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1177 + elf_ndxscn (scn));
1179 printf (ngettext ("\
1180 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1182 @@ -2066,9 +2082,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
1183 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1185 (unsigned int) shdr->sh_link,
1186 - elf_strptr (ebl->elf, shstrndx,
1187 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1188 - &glink)->sh_name));
1189 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1191 unsigned int offset = 0;
1192 for (int cnt = shdr->sh_info; --cnt >= 0; )
1193 @@ -2121,8 +2135,14 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
1194 error (EXIT_FAILURE, 0,
1195 gettext ("cannot get section header string table index"));
1197 + GElf_Shdr glink_mem;
1198 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1200 + if (glink == NULL)
1201 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1202 + elf_ndxscn (scn));
1204 int class = gelf_getclass (ebl->elf);
1206 printf (ngettext ("\
1207 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1209 @@ -2134,9 +2154,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
1210 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1212 (unsigned int) shdr->sh_link,
1213 - elf_strptr (ebl->elf, shstrndx,
1214 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1215 - &glink)->sh_name));
1216 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1218 unsigned int offset = 0;
1219 for (int cnt = shdr->sh_info; --cnt >= 0; )
1220 @@ -2398,8 +2416,14 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
1224 + GElf_Shdr glink_mem;
1225 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1227 + if (glink == NULL)
1228 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1229 + elf_ndxscn (scn));
1231 /* Print the header. */
1233 printf (ngettext ("\
1234 \nVersion symbols section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'",
1236 @@ -2411,9 +2435,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
1237 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1239 (unsigned int) shdr->sh_link,
1240 - elf_strptr (ebl->elf, shstrndx,
1241 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1242 - &glink)->sh_name));
1243 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1245 /* Now we can finally look at the actual contents of this section. */
1246 for (unsigned int cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1247 @@ -2465,7 +2487,17 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn,
1248 for (Elf32_Word cnt = 0; cnt < nbucket; ++cnt)
1249 ++counts[lengths[cnt]];
1252 + GElf_Shdr glink_mem;
1253 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf,
1256 + if (glink == NULL)
1258 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1259 + elf_ndxscn (scn));
1263 printf (ngettext ("\
1264 \nHistogram for bucket list length in section [%2u] '%s' (total of %d bucket):\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1266 @@ -2478,9 +2510,7 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn,
1269 (unsigned int) shdr->sh_link,
1270 - elf_strptr (ebl->elf, shstrndx,
1271 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1272 - &glink)->sh_name));
1273 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1275 if (extrastr != NULL)
1276 fputs (extrastr, stdout);
1277 @@ -4039,6 +4069,16 @@ print_debug_aranges_section (Dwfl_Module
1281 + GElf_Shdr glink_mem;
1283 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1284 + if (glink == NULL)
1286 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1287 + elf_ndxscn (scn));
1291 printf (ngettext ("\
1292 \nDWARF section '%s' at offset %#" PRIx64 " contains %zu entry:\n",
1294 --- elfutils-0.136/src/strip.c.robustify
1295 +++ elfutils-0.136/src/strip.c
1296 @@ -544,6 +544,11 @@ handle_elf (int fd, Elf *elf, const char
1300 + if (shstrndx >= shnum)
1303 +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
1305 /* Storage for section information. We leave room for two more
1306 entries since we unconditionally create a section header string
1307 table. Maybe some weird tool created an ELF file without one.
1308 @@ -565,7 +570,7 @@ handle_elf (int fd, Elf *elf, const char
1310 /* This should always be true (i.e., there should not be any
1311 holes in the numbering). */
1312 - assert (elf_ndxscn (scn) == cnt);
1313 + elf_assert (elf_ndxscn (scn) == cnt);
1315 shdr_info[cnt].scn = scn;
1317 @@ -578,6 +583,7 @@ handle_elf (int fd, Elf *elf, const char
1318 shdr_info[cnt].shdr.sh_name);
1319 if (shdr_info[cnt].name == NULL)
1322 error (0, 0, gettext ("illformed file '%s'"), fname);
1325 @@ -587,6 +593,8 @@ handle_elf (int fd, Elf *elf, const char
1327 /* Remember the shdr.sh_link value. */
1328 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
1329 + if (shdr_info[cnt].old_sh_link >= shnum)
1332 /* Sections in files other than relocatable object files which
1333 are not loaded can be freely moved by us. In relocatable
1334 @@ -599,7 +607,7 @@ handle_elf (int fd, Elf *elf, const char
1335 appropriate reference. */
1336 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
1338 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1339 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1340 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
1342 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
1343 @@ -616,7 +624,12 @@ handle_elf (int fd, Elf *elf, const char
1345 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
1348 + if (grpref[inner] < shnum)
1349 shdr_info[grpref[inner]].group_idx = cnt;
1354 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
1355 /* If the section group contains only one element and this
1356 @@ -627,7 +640,7 @@ handle_elf (int fd, Elf *elf, const char
1358 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
1360 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1361 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1362 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
1365 @@ -635,7 +648,7 @@ handle_elf (int fd, Elf *elf, const char
1366 discarded right away. */
1367 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
1369 - assert (shdr_info[cnt].group_idx != 0);
1370 + elf_assert (shdr_info[cnt].group_idx != 0);
1372 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
1374 @@ -710,11 +723,15 @@ handle_elf (int fd, Elf *elf, const char
1376 /* If a relocation section is marked as being removed make
1377 sure the section it is relocating is removed, too. */
1378 - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
1379 + if (shdr_info[cnt].shdr.sh_type == SHT_REL
1380 || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1381 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1383 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1385 + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1386 shdr_info[cnt].idx = 1;
1390 if (shdr_info[cnt].idx == 1)
1392 @@ -741,7 +758,7 @@ handle_elf (int fd, Elf *elf, const char
1393 if (shdr_info[cnt].symtab_idx != 0
1394 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
1396 - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1397 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1399 shdr_info[shdr_info[cnt].symtab_idx].data
1400 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1401 @@ -781,6 +798,9 @@ handle_elf (int fd, Elf *elf, const char
1402 else if (scnidx == SHN_XINDEX)
1405 + if (scnidx >= shnum)
1408 if (shdr_info[scnidx].idx == 0)
1409 /* This symbol table has a real symbol in
1410 a discarded section. So preserve the
1411 @@ -811,12 +831,16 @@ handle_elf (int fd, Elf *elf, const char
1414 /* Handle references through sh_info. */
1415 - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
1416 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1417 + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
1419 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1421 + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1423 shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1424 changes |= shdr_info[cnt].shdr.sh_info < cnt;
1428 /* Mark the section as investigated. */
1429 shdr_info[cnt].idx = 2;
1430 @@ -954,7 +978,7 @@ handle_elf (int fd, Elf *elf, const char
1431 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
1434 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1435 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1437 /* Add this name to the section header string table. */
1438 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
1439 @@ -991,7 +1015,7 @@ handle_elf (int fd, Elf *elf, const char
1440 error (EXIT_FAILURE, 0,
1441 gettext ("while create section header section: %s"),
1443 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1444 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1446 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
1447 if (shdr_info[cnt].data == NULL)
1448 @@ -1047,7 +1071,7 @@ handle_elf (int fd, Elf *elf, const char
1449 error (EXIT_FAILURE, 0,
1450 gettext ("while create section header section: %s"),
1452 - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1453 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1455 /* Finalize the string table and fill in the correct indices in the
1457 @@ -1137,20 +1161,20 @@ handle_elf (int fd, Elf *elf, const char
1458 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1461 - assert ((versiondata->d_size / sizeof (Elf32_Word))
1462 + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
1463 >= shdr_info[cnt].data->d_size / elsize);
1466 if (shdr_info[cnt].version_idx != 0)
1468 - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1469 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1470 /* This section has associated version
1471 information. We have to modify that
1472 information, too. */
1473 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
1476 - assert ((versiondata->d_size / sizeof (GElf_Versym))
1477 + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
1478 >= shdr_info[cnt].data->d_size / elsize);
1481 @@ -1205,7 +1229,7 @@ handle_elf (int fd, Elf *elf, const char
1482 sec = shdr_info[sym->st_shndx].idx;
1485 - assert (shndxdata != NULL);
1486 + elf_assert (shndxdata != NULL);
1488 sec = shdr_info[xshndx].idx;
1490 @@ -1226,7 +1250,7 @@ handle_elf (int fd, Elf *elf, const char
1494 - assert (sec < SHN_LORESERVE || shndxdata != NULL);
1495 + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
1497 if ((inner != destidx || nshndx != sym->st_shndx
1498 || (shndxdata != NULL && nxshndx != xshndx))
1499 @@ -1250,7 +1274,7 @@ handle_elf (int fd, Elf *elf, const char
1500 || shdr_info[cnt].debug_data == NULL)
1501 /* This is a section symbol for a section which has
1503 - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1504 + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1507 if (destidx != inner)
1508 @@ -1437,11 +1461,11 @@ handle_elf (int fd, Elf *elf, const char
1511 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1512 - assert (sym != NULL);
1513 + elf_assert (sym != NULL);
1515 const char *name = elf_strptr (elf, strshndx,
1517 - assert (name != NULL);
1518 + elf_assert (name != NULL);
1519 size_t hidx = elf_hash (name) % nbucket;
1521 if (bucket[hidx] == 0)
1522 @@ -1460,7 +1484,7 @@ handle_elf (int fd, Elf *elf, const char
1525 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
1526 - assert (shdr_info[cnt].shdr.sh_entsize
1527 + elf_assert (shdr_info[cnt].shdr.sh_entsize
1528 == sizeof (Elf64_Xword));
1530 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
1531 @@ -1491,11 +1515,11 @@ handle_elf (int fd, Elf *elf, const char
1534 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1535 - assert (sym != NULL);
1536 + elf_assert (sym != NULL);
1538 const char *name = elf_strptr (elf, strshndx,
1540 - assert (name != NULL);
1541 + elf_assert (name != NULL);
1542 size_t hidx = elf_hash (name) % nbucket;
1544 if (bucket[hidx] == 0)