https://sourceware.org/bugzilla/show_bug.cgi?id=24132
--- Comment #2 from poppeter1982 at gmail dot com --- Hi Nick nickc at redhat dot com <sourceware-bugzi...@sourceware.org> 于2019年1月25日周五 上午4:14写道： > https://sourceware.org/bugzilla/show_bug.cgi?id=24132 > > Nick Clifton <nickc at redhat dot com> changed: > > What |Removed |Added > > ---------------------------------------------------------------------------- > CC| |nickc at redhat dot com > > --- Comment #1 from Nick Clifton <nickc at redhat dot com> --- > (In reply to poppeter1982 from comment #0) > > Hi Peng, > > > if (dynamic_addr + dynamic_size >= filedata->file_size) > > > If you compile readelf with -fsanitize=unsigned-integer-overflow > > The version of gcc that I am using (8.2.1 on Fedora 29) does not support > a -fsanitize=unsigned-integer-overflow option. Is this a new feature ? > I used clang as the compilation frontend > > > > and run > > ./readelf -a input, it is found that dynamic_addr + dynamic_size > overflows > > and may bypass the check. Can you please help verify if it is a true > > positive > > I added a printf statement before the check to examine the values of > these variables: > > fprintf (stderr, "addr %lx size %llx file %llx plus %llx\n", > dynamic_addr, dynamic_size, filedata->file_size, > dynamic_addr + dynamic_size); > > But it appears that the arithmetic works: > > addr 22000016 size 60000e002200002f file c190d plus 60000e0044000045 > readelf: Error: the dynamic segment offset + size exceeds the size of the > file > > (This is with a 32-bit toolchain, which I presume you are using. You > did not actually specify how you configured your binutils build). > > The point is that the dynamic_size and file_size variables are both > unsigned long long types, and so the arithmetic does not overflow. > > So I think that the check should be OK. > I compiled binutils in 64-bits platform, and carefully checked the output. I agree with you that based on this input, the check will not be bypassed. However, do you think there exist the possibility that this check will fail due to overflow? I reported a similar issue https://sourceware.org/bugzilla/show_bug.cgi?id=24138, the check fails due to overflow in this case. Best, Peng -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ bug-binutils mailing list bug-binutils@gnu.org https://lists.gnu.org/mailman/listinfo/bug-binutils
