[Bug libelf/25083] Unexpected hangs at elf32_updatefile.c:518

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=25083

--- Comment #3 from Mark Wielaard  ---
(In reply to leftcopy.chx from comment #2)
> I see.
> Is there a need to provide an upper bound for the offset?

There is an offset for the upperbound that we might be able to detect. To be
valid the offset in the original file should not be larger than the file size. 
 For allocated sections that is the original executable file size/

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libelf/25083] Unexpected hangs at elf32_updatefile.c:518

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=25083

Mark Wielaard  changed:

   What|Removed |Added

 Status|NEW |ASSIGNED

--- Comment #4 from Mark Wielaard  ---
The following implements the sanity check and will prevent the hangs by
generating an error if the section offset of an allocated section in the
original file is too large when we have to preserve it:

diff --git a/src/unstrip.c b/src/unstrip.c
index fc878325..d9bafe5c 100644
--- a/src/unstrip.c
+++ b/src/unstrip.c
@@ -1388,6 +1388,17 @@ copy_elided_sections (Elf *unstripped, Elf *stripped,
 error (EXIT_FAILURE, 0, _("\
 more sections in stripped file than debug file -- arguments reversed?"));

+
+  /* Used as sanity check for allocated section offset, if the section
+ offset needs to be preserved.  We want to know the max size of the
+ ELF file, to check if any existing section offsets are OK.  */
+  int64_t max_off = -1;
+  if (stripped_ehdr->e_type != ET_REL)
+{
+  elf_flagelf (stripped, ELF_C_SET, ELF_F_LAYOUT);
+  max_off = elf_update (stripped, ELF_C_NULL);
+}
+
   /* Cache the stripped file's section details.  */
   struct section sections[stripped_shnum - 1];
   Elf_Scn *scn = NULL;
@@ -1675,6 +1686,11 @@ more sections in stripped file than debug file --
arguments reversed?"));
/* Preserve the file layout of the allocated sections.  */
if (stripped_ehdr->e_type != ET_REL && (shdr_mem.sh_flags & SHF_ALLOC))
  {
+   if (max_off > 0 && sec->shdr.sh_offset > (Elf64_Off) max_off)
+   error (EXIT_FAILURE, 0,
+  "allocated section offset too large [%zd] %" PRIx64,
+  elf_ndxscn (sec->scn), sec->shdr.sh_offset);
+
shdr_mem.sh_offset = sec->shdr.sh_offset;
placed[elf_ndxscn (sec->outscn) - 1] = true;

-- 
You are receiving this mail because:
You are on the CC list for the bug.