This is an archive of the discontinued LLVM Phabricator instance.

Differential D116639

[sanitizers] Fix integer underflow when parsing ELF.
ClosedPublic

Authored by fmayer on Jan 4 2022, 6:23 PM.

Details

Reviewers
eugenis
vitalybuka
Commits
rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF.

Diff Detail

Event Timeline

fmayer requested review of this revision.Jan 4 2022, 6:23 PM
fmayer created this revision.
Herald added a project: Restricted Project. · View Herald TranscriptJan 4 2022, 6:23 PM
Herald added a subscriber: Restricted Project. · View Herald Transcript
fmayer updated this revision to Diff 397440.Jan 4 2022, 6:37 PM

accidentally uploaded nonsense before

fmayer updated this revision to Diff 397442.Jan 4 2022, 6:38 PM

.

Harbormaster completed remote builds in B141596: Diff 397442.Jan 4 2022, 6:59 PM
vitalybuka accepted this revision.Jan 4 2022, 8:53 PM
This revision is now accepted and ready to land.Jan 4 2022, 8:53 PM
This revision was landed with ongoing or failed builds.Jan 4 2022, 9:47 PM
Closed by commit rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF. (authored by fmayer). · Explain Why
This revision was automatically updated to reflect the committed changes.
fmayer added a commit: rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF..

Revision Contents

PathSize
compiler-rt/
lib/
sanitizer_common/
2 lines

Diff 397459

compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp

Show First 20 Lines • Show All 599 Lines • ▼ Show 20 Lines if (phdr->p_type == PT_LOAD) {
uptr cur_beg = info->dlpi_addr + phdr->p_vaddr; uptr cur_beg = info->dlpi_addr + phdr->p_vaddr;
uptr cur_end = cur_beg + phdr->p_memsz; uptr cur_end = cur_beg + phdr->p_memsz;
bool executable = phdr->p_flags & PF_X; bool executable = phdr->p_flags & PF_X;
bool writable = phdr->p_flags & PF_W; bool writable = phdr->p_flags & PF_W;
cur_module.addAddressRange(cur_beg, cur_end, executable, cur_module.addAddressRange(cur_beg, cur_end, executable,
writable); writable);
} else if (phdr->p_type == PT_NOTE) { } else if (phdr->p_type == PT_NOTE) {
uptr off = 0; uptr off = 0;
while (off < phdr->p_memsz - sizeof(ElfW(Nhdr))) { while (off + sizeof(ElfW(Nhdr)) < phdr->p_memsz) {
auto *nhdr = reinterpret_cast<const ElfW(Nhdr) *>(info->dlpi_addr + auto *nhdr = reinterpret_cast<const ElfW(Nhdr) *>(info->dlpi_addr +
phdr->p_vaddr + off); phdr->p_vaddr + off);
constexpr auto kGnuNamesz = 4; // "GNU" with NUL-byte. constexpr auto kGnuNamesz = 4; // "GNU" with NUL-byte.
static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4."); static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4.");
if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) { if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) {
if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz > if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz >
phdr->p_memsz) { phdr->p_memsz) {
// Something is very wrong, bail out instead of reading potentially // Something is very wrong, bail out instead of reading potentially
▲ Show 20 Lines • Show All 410 Lines • Show Last 20 Lines