This is an archive of the discontinued LLVM Phabricator instance.

[sanitizers] Fix integer underflow when parsing ELF.
ClosedPublic

Authored by fmayer on Jan 4 2022, 6:23 PM.

Download Raw Diff

Details

Reviewers

eugenis
vitalybuka

Commits

rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF.

Diff Detail

Repository: rG LLVM Github Monorepo

Unit TestsFailed

	Time	Test
	90 ms	x64 debian > LLVM.Bindings/Go::go.test

Event Timeline

fmayer requested review of this revision.Jan 4 2022, 6:23 PM

fmayer created this revision.

Herald added a project: Restricted Project. · View Herald TranscriptJan 4 2022, 6:23 PM

Herald added a subscriber: Restricted Project. · View Herald Transcript

accidentally uploaded nonsense before

Harbormaster completed remote builds in B141596: Diff 397442.Jan 4 2022, 6:59 PM

vitalybuka accepted this revision.Jan 4 2022, 8:53 PM

This revision is now accepted and ready to land.Jan 4 2022, 8:53 PM

This revision was landed with ongoing or failed builds.Jan 4 2022, 9:47 PM

Closed by commit rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF. (authored by fmayer). · Explain Why

This revision was automatically updated to reflect the committed changes.

fmayer added a commit: rG4ecfa0a0c5fb: [sanitizers] Fix integer underflow when parsing ELF..

Revision Contents

Path

Size

compiler-rt/

lib/

sanitizer_common/

sanitizer_linux_libcdep.cpp

2 lines

Diff 397442

compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp

Show First 20 Lines • Show All 599 Lines • ▼ Show 20 Lines	if (phdr->p_type == PT_LOAD) {
uptr cur_beg = info->dlpi_addr + phdr->p_vaddr;		uptr cur_beg = info->dlpi_addr + phdr->p_vaddr;
uptr cur_end = cur_beg + phdr->p_memsz;		uptr cur_end = cur_beg + phdr->p_memsz;
bool executable = phdr->p_flags & PF_X;		bool executable = phdr->p_flags & PF_X;
bool writable = phdr->p_flags & PF_W;		bool writable = phdr->p_flags & PF_W;
cur_module.addAddressRange(cur_beg, cur_end, executable,		cur_module.addAddressRange(cur_beg, cur_end, executable,
writable);		writable);
} else if (phdr->p_type == PT_NOTE) {		} else if (phdr->p_type == PT_NOTE) {
uptr off = 0;		uptr off = 0;
while (off < phdr->p_memsz - sizeof(ElfW(Nhdr))) {		while (off + sizeof(ElfW(Nhdr)) < phdr->p_memsz) {
auto nhdr = reinterpret_cast<const ElfW(Nhdr) >(info->dlpi_addr +		auto nhdr = reinterpret_cast<const ElfW(Nhdr) >(info->dlpi_addr +
phdr->p_vaddr + off);		phdr->p_vaddr + off);
constexpr auto kGnuNamesz = 4; // "GNU" with NUL-byte.		constexpr auto kGnuNamesz = 4; // "GNU" with NUL-byte.
static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4.");		static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4.");
if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) {		if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) {
if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz >		if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz >
phdr->p_memsz) {		phdr->p_memsz) {
// Something is very wrong, bail out instead of reading potentially		// Something is very wrong, bail out instead of reading potentially
▲ Show 20 Lines • Show All 410 Lines • Show Last 20 Lines