Hi, On Fri, Oct 9, 2026 at 11:46 AM <[email protected]> wrote: > > This patch fixes a heap out-of-bounds read in print_cu_index_section() > (src/readelf.c:12363). > > The products section_count * 4 and unit_count * section_count * > off_bytes are computed in 32 bits and wrap, defeating the sanity > checks; the loop then indexes with 64-bit values, reading up to 4 GiB > out of bounds. ASan aborts on the PoC. > > The patch widens the arithmetic to size_t and adds a SIZE_MAX / > off_bytes / unit_count guard. Verified with an ASan build: the PoC > crashes before the patch and is clean after. > > Patch is attached as elfutils-fix.patch. > > AI tool use disclosure: AI was used in part for code audit and patch drafting.
Thank you for the patch. Is there any LLM output present in the patch? Elfutils' policy on LLM use (found in the CONTRIBUTING file in elfutils' root directory) prohibits LLM output from being included in any contributions. Using an LLM to research, debug or analyze your patch is fine but the patch must be free of LLM output. Also patches must contain a Signed-off-by tag in the commit message. Aaron
