[Object/ELF] - Do not crash on invalid sh_offset value of REL[A] section.

[grimar]

Summary

Previously code would access invalid memory and may crash,
patch fixes the issue. Used AFL and latest lld code with WIP patches applied to find.

[• rafael]

LGTM.

It should be possible to craft a similar crash by patching sh_size, no?

[grimar]

In D25187#559181, @rafael wrote:

LGTM.

It should be possible to craft a similar crash by patching sh_size, no?

Yes, I think so. I'll take a look what will happen and probably prepare a patch.

include/llvm/Object/ELF.h

public:
   }
   Elf_Sym_Range symbols(const Elf_Shdr *Sec) const {
     return makeArrayRef(symbol_begin(Sec), symbol_end(Sec));
   }
 
   const Elf_Rela *rela_begin(const Elf_Shdr *sec) const {
     if (sec->sh_entsize != sizeof(Elf_Rela))
       report_fatal_error("Invalid relocation entry size");
+    if (sec->sh_offset >= Buf.size())
+      report_fatal_error("Invalid relocation entry offset");
     return reinterpret_cast<const Elf_Rela *>(base() + sec->sh_offset);
   }
 
   const Elf_Rela *rela_end(const Elf_Shdr *sec) const {
     uint64_t Size = sec->sh_size;
     if (Size % sizeof(Elf_Rela))
       report_fatal_error("Invalid relocation table size");
     return rela_begin(sec) + Size / sizeof(Elf_Rela);
   }
 
   Elf_Rela_Range relas(const Elf_Shdr *Sec) const {
     return makeArrayRef(rela_begin(Sec), rela_end(Sec));
   }
 
   const Elf_Rel *rel_begin(const Elf_Shdr *sec) const {
     if (sec->sh_entsize != sizeof(Elf_Rel))
       report_fatal_error("Invalid relocation entry size");
+    if (sec->sh_offset >= Buf.size())
+      report_fatal_error("Invalid relocation entry offset");
     return reinterpret_cast<const Elf_Rel *>(base() + sec->sh_offset);
   }
 
   const Elf_Rel *rel_end(const Elf_Shdr *sec) const {
     uint64_t Size = sec->sh_size;
     if (Size % sizeof(Elf_Rel))
       report_fatal_error("Invalid relocation table size");
     return rel_begin(sec) + Size / sizeof(Elf_Rel);

test/Object/invalid.test

 
 
 RUN: not llvm-readobj -t %p/Inputs/invalid-symbol-table-size.elf 2>&1 | FileCheck --check-prefix=INVALID-SYMTAB-SIZE %s
 INVALID-SYMTAB-SIZE: Invalid symbol table size
 
 
 RUN: not llvm-readobj -t %p/Inputs/invalid-xindex-size.elf 2>&1 | FileCheck --check-prefix=INVALID-XINDEX-SIZE %s
 INVALID-XINDEX-SIZE: Invalid data was encountered while parsing the file.
+
+RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-i386 2>&1 | \
+RUN:   FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s
+RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-x86-64 2>&1 | \
+RUN:   FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s
+INVALID-RELOC-SH-OFFSET: Invalid relocation entry offset