This is an archive of the discontinued LLVM Phabricator instance.

[Object/ELF] - Check that e_shnum is null when e_shoff is.
ClosedPublic

Authored by grimar on Sep 30 2016, 4:30 AM.

Details

Summary

Spec says (http://www.sco.com/developers/gabi/1998-04-29/ch4.eheader.html) :
e_shnum
This member holds the number of entries in the section header table. Thus the product of e_shentsize and e_shnum gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value zero.

Revealed using "id_000037,sig_11,src_000015,op_havoc,rep_8" from PR30540

That was the reason of crash in lld on incorrect input file.
Binary reduced using afl-min.

Diff Detail

Repository
rL LLVM

Event Timeline

grimar updated this revision to Diff 73034.Sep 30 2016, 4:30 AM
grimar retitled this revision from to [Object/ELF] - Check that e_shnum is null when e_shoff is..
grimar updated this object.
grimar added reviewers: rafael, davide.
grimar added subscribers: llvm-commits, grimar, evgeny777.
rafael accepted this revision.Oct 14 2016, 8:23 PM
rafael edited edge metadata.

LGTM, but please also include a lld test as we might want to me a bit more lenient in here in the future.

This revision is now accepted and ready to land.Oct 14 2016, 8:23 PM
This revision was automatically updated to reflect the committed changes.

LGTM, but please also include a lld test as we might want to me a bit more lenient in here in the future.

r284375

Also I had to modify 2 precompiled inputs to commit this finally. Because it broke buildbots:
http://lab.llvm.org:8011/builders/llvm-clang-lld-x86_64-scei-ps4-ubuntu-fast/builds/21736/steps/test/logs/stdio

So I just zeroed the e_shnum fields in hex editor to let them pass this new check (https://reviews.llvm.org/rL284374).