2 2005-06-09 Roland McGrath <roland@redhat.com>
4 * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
5 (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
6 (handle_scngrp): Check for bogus sh_info.
8 * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
9 st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
10 Don't use assert on input values, instead bail with "illformed" error.
12 2005-05-17 Jakub Jelinek <jakub@redhat.com>
15 * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
16 table fits into object's bounds.
17 * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
18 elf->map_address. Check if first section header fits into object's
20 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Fix comment pasto.
21 Check if section header table fits into object's bounds.
22 * elf_begin.c (get_shnum): Ensure section headers fits into
24 (file_read_elf): Make sure scncnt is small enough to allocate both
25 ElfXX_Shdr and Elf_Scn array. Make sure section and program header
26 tables fit into object's bounds. Avoid memory leak on failure.
29 * elflint.c (check_hash): Don't check entries beyond end of section.
30 (check_note): Don't crash if gelf_rawchunk fails.
31 (section_name): Return <invalid> if gelf_getshdr returns NULL.
33 2005-05-14 Jakub Jelinek <jakub@redhat.com>
36 * libelfP.h (INVALID_NDX): Define.
37 * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
38 * gelf_getlib.c (gelf_getlib): Likewise.
39 * gelf_getmove.c (gelf_getmove): Likewise.
40 * gelf_getrel.c (gelf_getrel): Likewise.
41 * gelf_getrela.c (gelf_getrela): Likewise.
42 * gelf_getsym.c (gelf_getsym): Likewise.
43 * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
44 * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
45 * gelf_getversym.c (gelf_getversym): Likewise.
46 * gelf_update_dyn.c (gelf_update_dyn): Likewise.
47 * gelf_update_lib.c (gelf_update_lib): Likewise.
48 * gelf_update_move.c (gelf_update_move): Likewise.
49 * gelf_update_rel.c (gelf_update_rel): Likewise.
50 * gelf_update_rela.c (gelf_update_rela): Likewise.
51 * gelf_update_sym.c (gelf_update_sym): Likewise.
52 * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
53 * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
54 * gelf_update_versym.c (gelf_update_versym): Likewise.
55 * elf_newscn.c (elf_newscn): Check for overflow.
56 * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
57 (__elfw2(LIBELFBITS,updatefile)): Likewise.
58 * elf_begin.c (file_read_elf): Likewise.
59 * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
60 * elf_getarsym.c (elf_getarsym): Likewise.
61 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
63 * elflint.c (section_name): Return "<invalid>" instead of
64 crashing on invalid section name.
65 (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
66 check_symtab_shndx, check_hash, check_versym): Robustify.
68 --- elfutils-0.116/libelf/elf32_getphdr.c
69 +++ elfutils-0.116/libelf/elf32_getphdr.c
72 if (elf->map_address != NULL)
74 + /* First see whether the information in the ELF header is
75 + valid and it does not ask for too much. */
76 + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
77 + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
79 + /* Something is wrong. */
80 + __libelf_seterrno (ELF_E_INVALID_PHDR);
84 /* All the data is already mapped. Use it. */
85 if (ehdr->e_ident[EI_DATA] == MY_ELFDATA
87 --- elfutils-0.116/libelf/elf32_getshdr.c
88 +++ elfutils-0.116/libelf/elf32_getshdr.c
93 - if (INTUSE (elf_getshnum) (elf, &shnum) != 0)
94 + if (INTUSE (elf_getshnum) (elf, &shnum) != 0
95 + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
97 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
99 - /* Allocate memory for the program headers. We know the number
100 + /* Allocate memory for the section headers. We know the number
101 of entries from the ELF header. */
102 ElfW2(LIBELFBITS,Shdr) *shdr = elf->state.ELFW(elf,LIBELFBITS).shdr =
103 (ElfW2(LIBELFBITS,Shdr) *) malloc (size);
106 & (__alignof__ (ElfW2(LIBELFBITS,Shdr)) - 1)) != 0));
108 + /* First see whether the information in the ELF header is
109 + valid and it does not ask for too much. */
110 + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
111 + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
113 + /* Something is wrong. */
114 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
118 /* Now copy the data and at the same time convert the byte
121 --- elfutils-0.116/libelf/elf32_newphdr.c
122 +++ elfutils-0.116/libelf/elf32_newphdr.c
124 /* Create new ELF program header table.
125 - Copyright (C) 1999, 2000, 2002 Red Hat, Inc.
126 + Copyright (C) 1999, 2000, 2002, 2005 Red Hat, Inc.
127 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
129 This program is free software; you can redistribute it and/or modify
131 else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
132 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
134 + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
140 /* Allocate a new program header with the appropriate number of
142 result = (ElfW2(LIBELFBITS,Phdr) *)
143 --- elfutils-0.116/libelf/elf32_updatefile.c
144 +++ elfutils-0.116/libelf/elf32_updatefile.c
146 /* Write all the sections. Well, only those which are modified. */
149 + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
152 ElfW2(LIBELFBITS,Shdr) *shdr_dest;
153 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
154 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
156 /* Write all the sections. Well, only those which are modified. */
159 + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
160 + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
163 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
165 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
166 --- elfutils-0.116/libelf/elf_begin.c
167 +++ elfutils-0.116/libelf/elf_begin.c
170 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
172 - if (offset + ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
173 + if (unlikely (ehdr.e32->e_shoff >= maxsize)
174 + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
175 /* Cannot read the first section header. */
180 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
182 - if (offset + ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
183 + if (unlikely (ehdr.e64->e_shoff >= maxsize)
184 + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
185 /* Cannot read the first section header. */
189 /* Could not determine the number of sections. */
192 + /* Check for too many sections. */
193 + if (e_ident[EI_CLASS] == ELFCLASS32)
195 + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
198 + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
201 /* We can now allocate the memory. */
202 Elf *elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
203 ELF_K_ELF, scncnt * sizeof (Elf_Scn));
204 @@ -265,13 +276,31 @@
206 /* We can use the mmapped memory. */
207 elf->state.elf32.ehdr = ehdr;
209 + if (unlikely (ehdr->e_shoff >= maxsize)
210 + || unlikely (ehdr->e_shoff
211 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
215 + __libelf_seterrno (ELF_E_INVALID_FILE);
218 elf->state.elf32.shdr
219 = (Elf32_Shdr *) ((char *) ehdr + ehdr->e_shoff);
221 if (ehdr->e_phnum > 0)
222 - /* Assign a value only if there really is a program
223 - header. Otherwise the value remains NULL. */
224 - elf->state.elf32.phdr
225 - = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff);
227 + /* Assign a value only if there really is a program
228 + header. Otherwise the value remains NULL. */
229 + if (unlikely (ehdr->e_phoff >= maxsize)
230 + || unlikely (ehdr->e_phoff
232 + * sizeof (Elf32_Phdr) > maxsize))
234 + elf->state.elf32.phdr
235 + = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff);
238 for (size_t cnt = 0; cnt < scncnt; ++cnt)
240 @@ -340,13 +369,26 @@
242 /* We can use the mmapped memory. */
243 elf->state.elf64.ehdr = ehdr;
245 + if (unlikely (ehdr->e_shoff >= maxsize)
246 + || unlikely (ehdr->e_shoff
247 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
249 elf->state.elf64.shdr
250 = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff);
252 if (ehdr->e_phnum > 0)
253 - /* Assign a value only if there really is a program
254 - header. Otherwise the value remains NULL. */
255 - elf->state.elf64.phdr
256 - = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff);
258 + /* Assign a value only if there really is a program
259 + header. Otherwise the value remains NULL. */
260 + if (unlikely (ehdr->e_phoff >= maxsize)
261 + || unlikely (ehdr->e_phoff
263 + * sizeof (Elf32_Phdr) > maxsize))
265 + elf->state.elf64.phdr
266 + = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff);
269 for (size_t cnt = 0; cnt < scncnt; ++cnt)
271 --- elfutils-0.116/libelf/elf_getarsym.c
272 +++ elfutils-0.116/libelf/elf_getarsym.c
274 size_t index_size = atol (tmpbuf);
276 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
277 +#if SIZE_MAX <= 4294967295U
278 + || n >= SIZE_MAX / sizeof (Elf_Arsym)
280 || n * sizeof (uint32_t) > index_size)
282 /* This index table cannot be right since it does not fit into
283 --- elfutils-0.116/libelf/elf_getshstrndx.c
284 +++ elfutils-0.116/libelf/elf_getshstrndx.c
286 if (elf->map_address != NULL
287 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
289 - || (((size_t) ((char *) elf->map_address + offset))
290 + || (((size_t) ((char *) elf->map_address
291 + + elf->start_offset + offset))
292 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
293 - /* We can directly access the memory. */
294 - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
296 + /* First see whether the information in the ELF header is
297 + valid and it does not ask for too much. */
298 + if (unlikely (offset + sizeof (Elf32_Shdr)
299 + > elf->maximum_size))
301 + /* Something is wrong. */
302 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
307 + /* We can directly access the memory. */
308 + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
309 + + offset))->sh_link;
313 /* We avoid reading in all the section headers. Just read
314 @@ -130,10 +145,25 @@
315 if (elf->map_address != NULL
316 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
318 - || (((size_t) ((char *) elf->map_address + offset))
319 + || (((size_t) ((char *) elf->map_address
320 + + elf->start_offset + offset))
321 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
322 - /* We can directly access the memory. */
323 - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
325 + /* First see whether the information in the ELF header is
326 + valid and it does not ask for too much. */
327 + if (unlikely (offset + sizeof (Elf64_Shdr)
328 + > elf->maximum_size))
330 + /* Something is wrong. */
331 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
336 + /* We can directly access the memory. */
337 + num = ((Elf64_Shdr *) (elf->map_address
338 + + elf->start_offset + offset))->sh_link;
342 /* We avoid reading in all the section headers. Just read
343 --- elfutils-0.116/libelf/elf_newscn.c
344 +++ elfutils-0.116/libelf/elf_newscn.c
346 /* Append new section.
347 - Copyright (C) 1998, 1999, 2000, 2001, 2002 Red Hat, Inc.
348 + Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
349 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
351 This program is free software; you can redistribute it and/or modify
355 /* We must allocate a new element. */
357 + Elf_ScnList *newp = NULL;
359 assert (elf->state.elf.scnincr > 0);
361 - newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
362 - + ((elf->state.elf.scnincr *= 2)
363 - * sizeof (Elf_Scn)), 1);
365 +#if SIZE_MAX <= 4294967295U
366 + likely (elf->state.elf.scnincr
367 + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
372 + newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
373 + + ((elf->state.elf.scnincr *= 2)
374 + * sizeof (Elf_Scn)), 1);
377 __libelf_seterrno (ELF_E_NOMEM);
378 --- elfutils-0.116/libelf/gelf_getdyn.c
379 +++ elfutils-0.116/libelf/gelf_getdyn.c
381 /* Get information from dynamic table at the given index.
382 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
383 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
384 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
386 This program is free software; you can redistribute it and/or modify
388 table entries has to be adopted. The user better has provided
389 a buffer where we can store the information. While copying the
390 data we are converting the format. */
391 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
392 + if (INVALID_NDX (ndx, Elf32_Dyn)
393 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
395 __libelf_seterrno (ELF_E_INVALID_INDEX);
399 /* The data is already in the correct form. Just make sure the
401 - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
402 + if (INVALID_NDX (ndx, GElf_Dyn)
403 + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
405 __libelf_seterrno (ELF_E_INVALID_INDEX);
407 --- elfutils-0.116/libelf/gelf_getlib.c
408 +++ elfutils-0.116/libelf/gelf_getlib.c
410 /* Get library from table at the given index.
411 - Copyright (C) 2004 Red Hat, Inc.
412 + Copyright (C) 2004, 2005 Red Hat, Inc.
413 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
415 This program is free software; you can redistribute it and/or modify
417 /* The data is already in the correct form. Just make sure the
419 GElf_Lib *result = NULL;
420 - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
421 + if (INVALID_NDX (ndx, GElf_Lib)
422 + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
423 __libelf_seterrno (ELF_E_INVALID_INDEX);
426 --- elfutils-0.116/libelf/gelf_getmove.c
427 +++ elfutils-0.116/libelf/gelf_getmove.c
429 /* Get move structure at the given index.
430 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
431 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
432 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
434 This program is free software; you can redistribute it and/or modify
437 /* The data is already in the correct form. Just make sure the
439 - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
440 + if (INVALID_NDX (ndx, GElf_Move)
441 + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
443 __libelf_seterrno (ELF_E_INVALID_INDEX);
445 --- elfutils-0.116/libelf/gelf_getrela.c
446 +++ elfutils-0.116/libelf/gelf_getrela.c
448 /* Get RELA relocation information at given index.
449 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
450 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
451 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
453 This program is free software; you can redistribute it and/or modify
455 if (data_scn == NULL)
458 - if (unlikely (ndx < 0))
460 - __libelf_seterrno (ELF_E_INVALID_INDEX);
464 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
466 __libelf_seterrno (ELF_E_INVALID_HANDLE);
468 if (scn->elf->class == ELFCLASS32)
470 /* We have to convert the data. */
471 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
472 + if (INVALID_NDX (ndx, Elf32_Rela)
473 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
475 __libelf_seterrno (ELF_E_INVALID_INDEX);
479 /* Simply copy the data after we made sure we are actually getting
481 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
482 + if (INVALID_NDX (ndx, Elf64_Rela)
483 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
485 __libelf_seterrno (ELF_E_INVALID_INDEX);
487 --- elfutils-0.116/libelf/gelf_getrel.c
488 +++ elfutils-0.116/libelf/gelf_getrel.c
490 /* Get REL relocation information at given index.
491 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
492 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
493 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
495 This program is free software; you can redistribute it and/or modify
497 if (data_scn == NULL)
500 - if (unlikely (ndx < 0))
502 - __libelf_seterrno (ELF_E_INVALID_INDEX);
506 if (unlikely (data_scn->d.d_type != ELF_T_REL))
508 __libelf_seterrno (ELF_E_INVALID_HANDLE);
510 if (scn->elf->class == ELFCLASS32)
512 /* We have to convert the data. */
513 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
514 + if (INVALID_NDX (ndx, Elf32_Rel)
515 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
517 __libelf_seterrno (ELF_E_INVALID_INDEX);
521 /* Simply copy the data after we made sure we are actually getting
523 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
524 + if (INVALID_NDX (ndx, Elf64_Rel)
525 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
527 __libelf_seterrno (ELF_E_INVALID_INDEX);
529 --- elfutils-0.116/libelf/gelf_getsym.c
530 +++ elfutils-0.116/libelf/gelf_getsym.c
532 /* Get symbol information from symbol table at the given index.
533 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
534 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
535 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
537 This program is free software; you can redistribute it and/or modify
539 table entries has to be adopted. The user better has provided
540 a buffer where we can store the information. While copying the
541 data we are converting the format. */
542 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
543 + if (INVALID_NDX (ndx, Elf32_Sym)
544 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
546 __libelf_seterrno (ELF_E_INVALID_INDEX);
550 /* The data is already in the correct form. Just make sure the
552 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
553 + if (INVALID_NDX (ndx, GElf_Sym)
554 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
556 __libelf_seterrno (ELF_E_INVALID_INDEX);
558 --- elfutils-0.116/libelf/gelf_getsyminfo.c
559 +++ elfutils-0.116/libelf/gelf_getsyminfo.c
561 /* Get additional symbol information from symbol table at the given index.
562 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
563 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
564 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
566 This program is free software; you can redistribute it and/or modify
569 /* The data is already in the correct form. Just make sure the
571 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
572 + if (INVALID_NDX (ndx, GElf_Syminfo)
573 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
575 __libelf_seterrno (ELF_E_INVALID_INDEX);
577 --- elfutils-0.116/libelf/gelf_getsymshndx.c
578 +++ elfutils-0.116/libelf/gelf_getsymshndx.c
580 /* Get symbol information and separate section index from symbol table
582 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
583 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
584 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
586 This program is free software; you can redistribute it and/or modify
588 section index table. */
589 if (likely (shndxdata_scn != NULL))
591 - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
592 + if (INVALID_NDX (ndx, Elf32_Word)
593 + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
594 + > shndxdata_scn->d.d_size))
596 __libelf_seterrno (ELF_E_INVALID_INDEX);
599 table entries has to be adopted. The user better has provided
600 a buffer where we can store the information. While copying the
601 data we are converting the format. */
602 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
603 + if (INVALID_NDX (ndx, Elf32_Sym)
604 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
606 __libelf_seterrno (ELF_E_INVALID_INDEX);
610 /* The data is already in the correct form. Just make sure the
612 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
613 + if (INVALID_NDX (ndx, GElf_Sym)
614 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
616 __libelf_seterrno (ELF_E_INVALID_INDEX);
618 --- elfutils-0.116/libelf/gelf_getversym.c
619 +++ elfutils-0.116/libelf/gelf_getversym.c
621 /* Get symbol version information at the given index.
622 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
623 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
624 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
626 This program is free software; you can redistribute it and/or modify
629 /* The data is already in the correct form. Just make sure the
631 - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
632 + if (INVALID_NDX (ndx, GElf_Versym)
633 + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
635 __libelf_seterrno (ELF_E_INVALID_INDEX);
637 --- elfutils-0.116/libelf/gelf_update_dyn.c
638 +++ elfutils-0.116/libelf/gelf_update_dyn.c
640 /* Update information in dynamic table at the given index.
641 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
642 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
643 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
645 This program is free software; you can redistribute it and/or modify
650 - if (unlikely (ndx < 0))
652 - __libelf_seterrno (ELF_E_INVALID_INDEX);
656 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
658 /* The type of the data better should match. */
662 /* Check whether we have to resize the data buffer. */
663 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
664 + if (INVALID_NDX (ndx, Elf32_Dyn)
665 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
667 __libelf_seterrno (ELF_E_INVALID_INDEX);
672 /* Check whether we have to resize the data buffer. */
673 - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
674 + if (INVALID_NDX (ndx, Elf64_Dyn)
675 + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
677 __libelf_seterrno (ELF_E_INVALID_INDEX);
679 --- elfutils-0.116/libelf/gelf_update_lib.c
680 +++ elfutils-0.116/libelf/gelf_update_lib.c
682 /* Update library in table at the given index.
683 - Copyright (C) 2004 Red Hat, Inc.
684 + Copyright (C) 2004, 2005 Red Hat, Inc.
685 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
687 This program is free software; you can redistribute it and/or modify
692 - if (unlikely (ndx < 0))
694 - __libelf_seterrno (ELF_E_INVALID_INDEX);
698 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
699 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
703 /* Check whether we have to resize the data buffer. */
705 - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
706 + if (INVALID_NDX (ndx, Elf64_Lib)
707 + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
708 __libelf_seterrno (ELF_E_INVALID_INDEX);
711 --- elfutils-0.116/libelf/gelf_update_move.c
712 +++ elfutils-0.116/libelf/gelf_update_move.c
714 /* Update move structure at the given index.
715 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
716 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
717 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
719 This program is free software; you can redistribute it and/or modify
721 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
723 /* Check whether we have to resize the data buffer. */
724 - if (unlikely (ndx < 0)
725 + if (INVALID_NDX (ndx, GElf_Move)
726 || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
728 __libelf_seterrno (ELF_E_INVALID_INDEX);
729 --- elfutils-0.116/libelf/gelf_update_rela.c
730 +++ elfutils-0.116/libelf/gelf_update_rela.c
732 /* Update RELA relocation information at given index.
733 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
734 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
735 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
737 This program is free software; you can redistribute it and/or modify
742 - if (unlikely (ndx < 0))
744 - __libelf_seterrno (ELF_E_INVALID_INDEX);
748 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
750 /* The type of the data better should match. */
754 /* Check whether we have to resize the data buffer. */
755 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
756 + if (INVALID_NDX (ndx, Elf32_Rela)
757 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
759 __libelf_seterrno (ELF_E_INVALID_INDEX);
764 /* Check whether we have to resize the data buffer. */
765 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
766 + if (INVALID_NDX (ndx, Elf64_Rela)
767 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
769 __libelf_seterrno (ELF_E_INVALID_INDEX);
771 --- elfutils-0.116/libelf/gelf_update_rel.c
772 +++ elfutils-0.116/libelf/gelf_update_rel.c
774 /* Update REL relocation information at given index.
775 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
776 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
777 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
779 This program is free software; you can redistribute it and/or modify
784 - if (unlikely (ndx < 0))
786 - __libelf_seterrno (ELF_E_INVALID_INDEX);
790 if (unlikely (data_scn->d.d_type != ELF_T_REL))
792 /* The type of the data better should match. */
796 /* Check whether we have to resize the data buffer. */
797 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
798 + if (INVALID_NDX (ndx, Elf32_Rel)
799 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
801 __libelf_seterrno (ELF_E_INVALID_INDEX);
806 /* Check whether we have to resize the data buffer. */
807 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
808 + if (INVALID_NDX (ndx, Elf64_Rel)
809 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
811 __libelf_seterrno (ELF_E_INVALID_INDEX);
813 --- elfutils-0.116/libelf/gelf_update_sym.c
814 +++ elfutils-0.116/libelf/gelf_update_sym.c
816 /* Update symbol information in symbol table at the given index.
817 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
818 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
819 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
821 This program is free software; you can redistribute it and/or modify
826 - if (unlikely (ndx < 0))
828 - __libelf_seterrno (ELF_E_INVALID_INDEX);
832 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
834 /* The type of the data better should match. */
838 /* Check whether we have to resize the data buffer. */
839 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
840 + if (INVALID_NDX (ndx, Elf32_Sym)
841 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
843 __libelf_seterrno (ELF_E_INVALID_INDEX);
848 /* Check whether we have to resize the data buffer. */
849 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
850 + if (INVALID_NDX (ndx, Elf64_Sym)
851 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
853 __libelf_seterrno (ELF_E_INVALID_INDEX);
855 --- elfutils-0.116/libelf/gelf_update_syminfo.c
856 +++ elfutils-0.116/libelf/gelf_update_syminfo.c
858 /* Update additional symbol information in symbol table at the given index.
859 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
860 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
861 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
863 This program is free software; you can redistribute it and/or modify
868 - if (unlikely (ndx < 0))
870 - __libelf_seterrno (ELF_E_INVALID_INDEX);
874 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
876 /* The type of the data better should match. */
878 rwlock_wrlock (scn->elf->lock);
880 /* Check whether we have to resize the data buffer. */
881 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
882 + if (INVALID_NDX (ndx, GElf_Syminfo)
883 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
885 __libelf_seterrno (ELF_E_INVALID_INDEX);
887 --- elfutils-0.116/libelf/gelf_update_symshndx.c
888 +++ elfutils-0.116/libelf/gelf_update_symshndx.c
890 /* Update symbol information and section index in symbol table at the
892 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
893 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
894 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
896 This program is free software; you can redistribute it and/or modify
901 - if (unlikely (ndx < 0))
903 - __libelf_seterrno (ELF_E_INVALID_INDEX);
907 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
909 /* The type of the data better should match. */
913 /* Check whether we have to resize the data buffer. */
914 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
915 + if (INVALID_NDX (ndx, Elf32_Sym)
916 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
918 __libelf_seterrno (ELF_E_INVALID_INDEX);
923 /* Check whether we have to resize the data buffer. */
924 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
925 + if (INVALID_NDX (ndx, Elf64_Sym)
926 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
928 __libelf_seterrno (ELF_E_INVALID_INDEX);
930 --- elfutils-0.116/libelf/gelf_update_versym.c
931 +++ elfutils-0.116/libelf/gelf_update_versym.c
933 /* Update symbol version information.
934 - Copyright (C) 2001, 2002 Red Hat, Inc.
935 + Copyright (C) 2001, 2002, 2005 Red Hat, Inc.
936 Written by Ulrich Drepper <drepper@redhat.com>, 2001.
938 This program is free software; you can redistribute it and/or modify
940 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
942 /* Check whether we have to resize the data buffer. */
943 - if (unlikely (ndx < 0)
944 + if (INVALID_NDX (ndx, GElf_Versym)
945 || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
947 __libelf_seterrno (ELF_E_INVALID_INDEX);
948 --- elfutils-0.116/libelf/libelfP.h
949 +++ elfutils-0.116/libelf/libelfP.h
954 +/* Convenience macro. Assumes int NDX and TYPE with size at least
956 +#if SIZE_MAX > 4294967295U
957 +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
959 +# define INVALID_NDX(ndx, type) \
960 + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
963 #endif /* libelfP.h */
964 --- elfutils-0.116/src/elflint.c
965 +++ elfutils-0.116/src/elflint.c
967 /* Array to count references in section groups. */
970 +/* Number of sections. */
971 +static unsigned int shnum;
975 main (int argc, char *argv[])
976 @@ -300,10 +303,19 @@
982 + if ((unsigned int) idx > shnum)
983 + return "<invalid>";
985 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
987 + return "<invalid>";
989 - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
990 + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
992 + return "<invalid>";
998 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
1001 -/* Number of sections. */
1002 -static unsigned int shnum;
1006 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
1012 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
1013 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
1014 + if (shdr->sh_entsize != sh_entsize)
1016 section [%2zu] '%s': entry size is does not match ElfXX_Sym\n"),
1017 cnt, section_name (ebl, cnt));
1019 xndxscnidx, section_name (ebl, xndxscnidx));
1022 - for (cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1023 + for (cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
1025 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
1030 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
1031 - assert (name != NULL);
1032 + assert (name != NULL
1033 + || strshdr->sh_type != SHT_STRTAB);
1036 if (sym->st_shndx == SHN_XINDEX)
1038 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
1039 assert (rcshdr != NULL);
1041 - if (rcshdr->sh_type == SHT_DYNAMIC)
1042 + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
1044 /* Found the dynamic section. Look through it. */
1045 Elf_Data *d = elf_getdata (scn, NULL);
1046 @@ -968,14 +978,17 @@
1049 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
1050 - assert (dyn != NULL);
1055 if (dyn->d_tag == DT_RELCOUNT)
1057 /* Found it. One last check: does the number
1058 specified number of relative relocations exceed
1059 the total number of relocations? */
1060 - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
1061 + if (shdr->sh_entsize
1062 + && dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
1064 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
1065 idx, section_name (ebl, idx),
1066 @@ -1050,7 +1063,8 @@
1070 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT))
1071 + size_t sh_entsize = gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT);
1072 + if (shdr->sh_entsize != sh_entsize)
1073 ERROR (gettext (reltype == ELF_T_RELA ? "\
1074 section [%2d] '%s': section entry size does not match ElfXX_Rela\n" : "\
1075 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
1076 @@ -1258,7 +1272,8 @@
1077 Elf_Data *symdata = elf_getdata (symscn, NULL);
1078 enum load_state state = state_undecided;
1080 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1081 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
1082 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1085 GElf_Rela *rela = gelf_getrela (data, cnt, &rela_mem);
1086 @@ -1307,7 +1322,8 @@
1087 Elf_Data *symdata = elf_getdata (symscn, NULL);
1088 enum load_state state = state_undecided;
1090 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1091 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
1092 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1095 GElf_Rel *rel = gelf_getrel (data, cnt, &rel_mem);
1096 @@ -1408,7 +1424,8 @@
1097 shdr->sh_link, section_name (ebl, shdr->sh_link),
1098 idx, section_name (ebl, idx));
1100 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
1101 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
1102 + if (shdr->sh_entsize != sh_entsize)
1104 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
1105 idx, section_name (ebl, idx));
1106 @@ -1418,7 +1435,7 @@
1107 idx, section_name (ebl, idx));
1109 bool non_null_warned = false;
1110 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1111 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1114 GElf_Dyn *dyn = gelf_getdyn (data, cnt, &dyn_mem);
1115 @@ -1559,6 +1576,8 @@
1116 idx, section_name (ebl, idx));
1119 + && shdr->sh_entsize
1120 + && symshdr->sh_entsize
1121 && (shdr->sh_size / shdr->sh_entsize
1122 < symshdr->sh_size / symshdr->sh_entsize))
1124 @@ -1585,6 +1604,12 @@
1127 Elf_Data *data = elf_getdata (elf_getscn (ebl->elf, idx), NULL);
1130 + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
1131 + idx, section_name (ebl, idx));
1135 if (*((Elf32_Word *) data->d_buf) != 0)
1136 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
1137 @@ -1665,23 +1690,30 @@
1138 idx, section_name (ebl, idx), (long int) shdr->sh_size,
1139 (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
1141 - if (symshdr != NULL)
1142 + if (symshdr != NULL && symshdr->sh_entsize)
1144 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
1146 + Elf32_Word *buf, *end;
1148 if (nchain < symshdr->sh_size / symshdr->sh_entsize)
1149 ERROR (gettext ("section [%2d] '%s': chain array not large enough\n"),
1150 idx, section_name (ebl, idx));
1152 + buf = ((Elf32_Word *) data->d_buf) + 2;
1153 + end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
1154 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1155 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
1158 + else if (*buf++ >= symsize)
1160 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1161 idx, section_name (ebl, idx), cnt - 2);
1163 for (; cnt < 2 + nbucket + nchain; ++cnt)
1164 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
1167 + else if (*buf++ >= symsize)
1169 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
1170 idx, section_name (ebl, idx), cnt - 2 - nbucket);
1171 @@ -2023,8 +2055,9 @@
1173 /* The number of elements in the version symbol table must be the
1174 same as the number of symbols. */
1175 - if (shdr->sh_size / shdr->sh_entsize
1176 - != symshdr->sh_size / symshdr->sh_entsize)
1177 + if (shdr->sh_entsize && symshdr->sh_entsize
1178 + && (shdr->sh_size / shdr->sh_entsize
1179 + != symshdr->sh_size / symshdr->sh_entsize))
1181 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
1182 idx, section_name (ebl, idx),
1183 @@ -2928,6 +2961,8 @@
1186 char *notemem = gelf_rawchunk (ebl->elf, phdr->p_offset, phdr->p_filesz);
1187 + if (notemem == NULL)
1190 /* ELF64 files often use note section entries in the 32-bit format.
1191 The p_align field is set to 8 in case the 64-bit format is used.
1192 --- elfutils-0.116/src/readelf.c
1193 +++ elfutils-0.116/src/readelf.c
1195 Elf32_Word *grpref = (Elf32_Word *) data->d_buf;
1198 + GElf_Sym *sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
1200 printf ((grpref[0] & GRP_COMDAT)
1202 \nCOMDAT section group [%2zu] '%s' with signature '%s' contains %zu entry:\n",
1204 data->d_size / sizeof (Elf32_Word) - 1),
1206 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
1207 - elf_strptr (ebl->elf, symshdr->sh_link,
1208 - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
1209 + (sym == NULL ? NULL
1210 + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
1211 ?: gettext ("<INVALID SYMBOL>"),
1212 data->d_size / sizeof (Elf32_Word) - 1);
1214 @@ -1110,7 +1112,8 @@
1215 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
1217 int class = gelf_getclass (ebl->elf);
1219 + GElf_Shdr glink_mem;
1224 @@ -1125,6 +1128,11 @@
1225 error (EXIT_FAILURE, 0,
1226 gettext ("cannot get section header string table index"));
1228 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1229 + if (glink == NULL)
1230 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1231 + elf_ndxscn (scn));
1233 printf (ngettext ("\
1234 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1236 @@ -1134,9 +1142,7 @@
1237 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1239 (int) shdr->sh_link,
1240 - elf_strptr (ebl->elf, shstrndx,
1241 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1242 - &glink)->sh_name));
1243 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1244 fputs_unlocked (gettext (" Type Value\n"), stdout);
1246 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1247 @@ -1654,6 +1660,13 @@
1248 error (EXIT_FAILURE, 0,
1249 gettext ("cannot get section header string table index"));
1251 + GElf_Shdr glink_mem;
1252 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1254 + if (glink == NULL)
1255 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1256 + elf_ndxscn (scn));
1258 /* Now we can compute the number of entries in the section. */
1259 unsigned int nsyms = data->d_size / (class == ELFCLASS32
1260 ? sizeof (Elf32_Sym)
1261 @@ -1664,15 +1677,12 @@
1263 (unsigned int) elf_ndxscn (scn),
1264 elf_strptr (ebl->elf, shstrndx, shdr->sh_name), nsyms);
1266 printf (ngettext (" %lu local symbol String table: [%2u] '%s'\n",
1267 " %lu local symbols String table: [%2u] '%s'\n",
1269 (unsigned long int) shdr->sh_info,
1270 (unsigned int) shdr->sh_link,
1271 - elf_strptr (ebl->elf, shstrndx,
1272 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1273 - &glink)->sh_name));
1274 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1276 fputs_unlocked (class == ELFCLASS32
1278 @@ -1908,7 +1918,13 @@
1279 error (EXIT_FAILURE, 0,
1280 gettext ("cannot get section header string table index"));
1283 + GElf_Shdr glink_mem;
1284 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1286 + if (glink == NULL)
1287 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1288 + elf_ndxscn (scn));
1290 printf (ngettext ("\
1291 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1293 @@ -1919,9 +1935,7 @@
1294 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1296 (unsigned int) shdr->sh_link,
1297 - elf_strptr (ebl->elf, shstrndx,
1298 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1299 - &glink)->sh_name));
1300 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1302 unsigned int offset = 0;
1303 for (int cnt = shdr->sh_info; --cnt >= 0; )
1304 @@ -1974,8 +1988,14 @@
1305 error (EXIT_FAILURE, 0,
1306 gettext ("cannot get section header string table index"));
1308 + GElf_Shdr glink_mem;
1309 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1311 + if (glink == NULL)
1312 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1313 + elf_ndxscn (scn));
1315 int class = gelf_getclass (ebl->elf);
1317 printf (ngettext ("\
1318 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1320 @@ -1987,9 +2007,7 @@
1321 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1323 (unsigned int) shdr->sh_link,
1324 - elf_strptr (ebl->elf, shstrndx,
1325 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1326 - &glink)->sh_name));
1327 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1329 unsigned int offset = 0;
1330 for (int cnt = shdr->sh_info; --cnt >= 0; )
1331 @@ -2251,8 +2269,14 @@
1335 + GElf_Shdr glink_mem;
1336 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1338 + if (glink == NULL)
1339 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1340 + elf_ndxscn (scn));
1342 /* Print the header. */
1344 printf (ngettext ("\
1345 \nVersion symbols section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'",
1347 @@ -2264,9 +2288,7 @@
1348 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1350 (unsigned int) shdr->sh_link,
1351 - elf_strptr (ebl->elf, shstrndx,
1352 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1353 - &glink)->sh_name));
1354 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1356 /* Now we can finally look at the actual contents of this section. */
1357 for (unsigned int cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1358 @@ -2341,7 +2363,17 @@
1359 Elf32_Word *bucket = &((Elf32_Word *) data->d_buf)[2];
1360 Elf32_Word *chain = &((Elf32_Word *) data->d_buf)[2 + nbucket];
1363 + GElf_Shdr glink_mem;
1364 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf,
1367 + if (glink == NULL)
1369 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1370 + elf_ndxscn (scn));
1374 printf (ngettext ("\
1375 \nHistogram for bucket list length in section [%2u] '%s' (total of %d bucket):\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1377 @@ -2354,10 +2386,7 @@
1380 (unsigned int) shdr->sh_link,
1381 - elf_strptr (ebl->elf, shstrndx,
1382 - gelf_getshdr (elf_getscn (ebl->elf,
1384 - &glink)->sh_name));
1385 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1387 uint32_t *lengths = (uint32_t *) xcalloc (nbucket,
1389 @@ -3460,6 +3489,16 @@
1393 + GElf_Shdr glink_mem;
1395 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1396 + if (glink == NULL)
1398 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1399 + elf_ndxscn (scn));
1403 printf (ngettext ("\
1404 \nDWARF section '%s' at offset %#" PRIx64 " contains %zu entry:\n",
1406 --- elfutils-0.116/src/strip.c
1407 +++ elfutils-0.116/src/strip.c
1409 Elf_Data debuglink_crc_data;
1410 bool any_symtab_changes = false;
1411 Elf_Data *shstrtab_data = NULL;
1412 + size_t shdridx = 0;
1414 /* Create the full name of the file. */
1416 @@ -530,6 +531,11 @@
1420 + if (shstrndx >= shnum)
1423 +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
1425 /* Storage for section information. We leave room for two more
1426 entries since we unconditionally create a section header string
1427 table. Maybe some weird tool created an ELF file without one.
1430 /* This should always be true (i.e., there should not be any
1431 holes in the numbering). */
1432 - assert (elf_ndxscn (scn) == cnt);
1433 + elf_assert (elf_ndxscn (scn) == cnt);
1435 shdr_info[cnt].scn = scn;
1438 shdr_info[cnt].shdr.sh_name);
1439 if (shdr_info[cnt].name == NULL)
1442 error (0, 0, gettext ("illformed file '%s'"), fname);
1447 /* Remember the shdr.sh_link value. */
1448 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
1449 + if (shdr_info[cnt].old_sh_link >= shnum)
1452 /* Sections in files other than relocatable object files which
1453 are not loaded can be freely moved by us. In relocatable
1455 appropriate reference. */
1456 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
1458 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1459 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1460 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
1462 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
1463 @@ -602,7 +611,12 @@
1465 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
1467 - shdr_info[grpref[inner]].group_idx = cnt;
1469 + if (grpref[inner] < shnum)
1470 + shdr_info[grpref[inner]].group_idx = cnt;
1475 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
1476 /* If the section group contains only one element and this
1479 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
1481 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1482 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1483 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
1487 discarded right away. */
1488 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
1490 - assert (shdr_info[cnt].group_idx != 0);
1491 + elf_assert (shdr_info[cnt].group_idx != 0);
1493 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
1495 @@ -696,10 +710,14 @@
1497 /* If a relocation section is marked as being removed make
1498 sure the section it is relocating is removed, too. */
1499 - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
1500 - || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1501 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1502 - shdr_info[cnt].idx = 1;
1503 + if (shdr_info[cnt].shdr.sh_type == SHT_REL
1504 + || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1506 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1508 + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1509 + shdr_info[cnt].idx = 1;
1513 if (shdr_info[cnt].idx == 1)
1515 if (shdr_info[cnt].symtab_idx != 0
1516 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
1518 - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1519 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1521 shdr_info[shdr_info[cnt].symtab_idx].data
1522 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1524 else if (scnidx == SHN_XINDEX)
1527 + if (scnidx >= shnum)
1530 if (shdr_info[scnidx].idx == 0)
1532 /* Mark this section as used. */
1533 @@ -796,11 +817,15 @@
1536 /* Handle references through sh_info. */
1537 - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
1538 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1539 + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
1541 - shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1542 - changes |= shdr_info[cnt].shdr.sh_info < cnt;
1543 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1545 + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1547 + shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1548 + changes |= shdr_info[cnt].shdr.sh_info < cnt;
1552 /* Mark the section as investigated. */
1554 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
1557 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1558 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1560 /* Add this name to the section header string table. */
1561 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
1563 error (EXIT_FAILURE, 0,
1564 gettext ("while create section header section: %s"),
1566 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1567 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1569 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
1570 if (shdr_info[cnt].data == NULL)
1574 /* Index of the section header table in the shdr_info array. */
1575 - size_t shdridx = cnt;
1578 /* Add the section header string table section name. */
1579 shdr_info[cnt].se = ebl_strtabadd (shst, ".shstrtab", 10);
1580 @@ -993,7 +1018,7 @@
1581 error (EXIT_FAILURE, 0,
1582 gettext ("while create section header section: %s"),
1584 - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1585 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1587 /* Finalize the string table and fill in the correct indices in the
1589 @@ -1083,21 +1108,21 @@
1590 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1593 - assert ((versiondata->d_size / sizeof (Elf32_Word))
1594 - >= shdr_info[cnt].data->d_size / elsize);
1595 + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
1596 + >= shdr_info[cnt].data->d_size / elsize);
1599 if (shdr_info[cnt].version_idx != 0)
1601 - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1602 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1603 /* This section has associated version
1604 information. We have to modify that
1605 information, too. */
1606 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
1609 - assert ((versiondata->d_size / sizeof (GElf_Versym))
1610 - >= shdr_info[cnt].data->d_size / elsize);
1611 + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
1612 + >= shdr_info[cnt].data->d_size / elsize);
1615 shdr_info[cnt].newsymidx
1616 @@ -1151,7 +1176,7 @@
1617 sec = shdr_info[sym->st_shndx].idx;
1620 - assert (shndxdata != NULL);
1621 + elf_assert (shndxdata != NULL);
1623 sec = shdr_info[xshndx].idx;
1625 @@ -1172,7 +1197,7 @@
1629 - assert (sec < SHN_LORESERVE || shndxdata != NULL);
1630 + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
1632 if ((inner != destidx || nshndx != sym->st_shndx
1633 || (shndxdata != NULL && nxshndx != xshndx))
1634 @@ -1195,7 +1220,7 @@
1636 /* This is a section symbol for a section which has
1638 - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1639 + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1642 if (destidx != inner)
1643 @@ -1359,11 +1384,11 @@
1646 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1647 - assert (sym != NULL);
1648 + elf_assert (sym != NULL);
1650 const char *name = elf_strptr (elf, strshndx,
1652 - assert (name != NULL);
1653 + elf_assert (name != NULL);
1654 size_t hidx = elf_hash (name) % nbucket;
1656 if (bucket[hidx] == 0)
1657 @@ -1382,8 +1407,8 @@
1660 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
1661 - assert (shdr_info[cnt].shdr.sh_entsize
1662 - == sizeof (Elf64_Xword));
1663 + elf_assert (shdr_info[cnt].shdr.sh_entsize
1664 + == sizeof (Elf64_Xword));
1666 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
1668 @@ -1416,11 +1441,11 @@
1671 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1672 - assert (sym != NULL);
1673 + elf_assert (sym != NULL);
1675 const char *name = elf_strptr (elf, strshndx,
1677 - assert (name != NULL);
1678 + elf_assert (name != NULL);
1679 size_t hidx = elf_hash (name) % nbucket;
1681 if (bucket[hidx] == 0)