llvm-objdump: corrupt ELF file can crash llvm-objdump in printSymbolVersionDefinition() #86611
Assignees
Comments
|
@llvm/issue-subscribers-tools-llvm-objdump Author: Ed Maste (emaste)
Reported against FreeBSD in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277861, with ELF reproducer attached
|
|
Does this reproduce with HEAD? There was very recent fix to the LLVM object library which might cover this case (though it is probably unrelated).
I wouldn't be surprised if this is somehow related. I think it's going to be difficult to triage this without the actual object file though. |
|
@jh7370, the object file is attached in the link within the report. I think something like the following should suffice: --- a/llvm/tools/llvm-objdump/ELFDump.cpp
+++ b/llvm/tools/llvm-objdump/ELFDump.cpp
@@ -39,6 +39,9 @@ private:
void printProgramHeaders();
void printSymbolVersion();
void printSymbolVersionDependency(const typename ELFT::Shdr &Sec);
+ void printSymbolVersionDefinition(const typename ELFT::Shdr &Shdr,
+ ArrayRef<uint8_t> Contents,
+ StringRef StrTab);
};
} // namespace
@@ -375,9 +378,9 @@ void ELFDumper<ELFT>::printSymbolVersionDependency(
}
template <class ELFT>
-static void printSymbolVersionDefinition(const typename ELFT::Shdr &Shdr,
- ArrayRef<uint8_t> Contents,
- StringRef StrTab) {
+void ELFDumper<ELFT>::printSymbolVersionDefinition(
+ const typename ELFT::Shdr &Shdr, ArrayRef<uint8_t> Contents,
+ StringRef StrTab) {
outs() << "\nVersion definitions:\n";
const uint8_t *Buf = Contents.data();
@@ -393,6 +396,13 @@ static void printSymbolVersionDefinition(const typename ELFT::Shdr &Shdr,
<< format("0x%08" PRIx32 " ", (uint32_t)Verdef->vd_hash);
const uint8_t *BufAux = Buf + Verdef->vd_aux;
+ if (BufAux > Contents.end()) {
+ reportWarning("out-of-bound while parsing verdaux entries, corrupted "
+ "verdef section",
+ Obj.getFileName());
+ break;
+ }
+
uint16_t VerdauxIndex = 0;
while (BufAux) {(Also taking a look at tests for previous fixes). |
|
@antoniofrighetto This looks good. Can you upload a patch with a test? |
antoniofrighetto
added a commit
to antoniofrighetto/llvm-project
that referenced
this issue
Nov 7, 2024
…past size Validate `vd_aux` while parsing `Elf_Verdef` structure. Fixes: llvm#86611.
Candidate patch: #115284 (sorry for replying back only now). |
antoniofrighetto
added a commit
to antoniofrighetto/llvm-project
that referenced
this issue
Nov 7, 2024
…past size Validate `vd_aux` while parsing `Elf_Verdef` structure. Fixes: llvm#86611.
antoniofrighetto
added a commit
to antoniofrighetto/llvm-project
that referenced
this issue
Nov 8, 2024
…past size Validate `vd_aux` while parsing `Elf_Verdef` structure. Fixes: llvm#86611.
antoniofrighetto
added a commit
to antoniofrighetto/llvm-project
that referenced
this issue
Nov 8, 2024
…past size Validate `vd_aux` while parsing `Elf_Verdef` structure. Fixes: llvm#86611.
cheezeburglar
pushed a commit
to cheezeburglar/llvm-project
that referenced
this issue
Feb 28, 2025
and fix crash when vd_aux is invalid (llvm#86611). vd_version, vd_flags, vd_ndx, and vd_cnt in Elf{32,64}_Verdef are 16-bit. Change VerDef to use uint16_t instead. vda_name specifies a NUL-terminated string. Update getVersionDefinitions to remove some `.c_str()`. Pull Request: llvm#128434
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reported against FreeBSD in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277861, with ELF reproducer attached
The text was updated successfully, but these errors were encountered: