This is an archive of the discontinued LLVM Phabricator instance.

Differential D25514

[Object/ELF] - Do not allow overflow when checking section size/offset.
ClosedPublic

Authored by grimar on Oct 12 2016, 7:07 AM.

Details

Reviewers
davide
• rafael
Summary

Overflow was the reason of incorrect passing the check,
patch fixes the case.

Diff Detail

Event Timeline

grimar updated this revision to Diff 74369.Oct 12 2016, 7:07 AM
grimar retitled this revision from to [Object/ELF] - Do not allow overflow when checking section size/offset..
grimar updated this object.
grimar added reviewers: • rafael, davide.
grimar added subscribers: llvm-commits, grimar, evgeny777.
grimar added a comment.Oct 18 2016, 9:35 AM

Ping.

• rafael accepted this revision.Oct 25 2016, 3:22 PM
• rafael edited edge metadata.

LGTM

This revision is now accepted and ready to land.Oct 25 2016, 3:22 PM
grimar closed this revision.Oct 31 2016, 7:46 AM

r285284

Revision Contents

PathSize
include/
llvm/
Object/
ELF.h
ELF.h (revision 283988)
3 lines
test/
Object/
Inputs/
invalid-section-size2.elf
invalid-section-size2.elf (nonexistent)
invalid.test
invalid.test (revision 283988)
4 lines

Diff 74369

include/llvm/Object/ELF.h

Show First 20 Lines • Show All 220 Lines • ▼ Show 20 LinesELFFile<ELFT>::getSectionContentsAsArray(const Elf_Shdr *Sec) const {
if (Sec->sh_entsize != sizeof(T) && sizeof(T) != 1) if (Sec->sh_entsize != sizeof(T) && sizeof(T) != 1)
return object_error::parse_failed; return object_error::parse_failed;
uintX_t Offset = Sec->sh_offset; uintX_t Offset = Sec->sh_offset;
uintX_t Size = Sec->sh_size; uintX_t Size = Sec->sh_size;
if (Size % sizeof(T)) if (Size % sizeof(T))
return object_error::parse_failed; return object_error::parse_failed;
if (Offset + Size > Buf.size()) if ((std::numeric_limits<uintX_t>::max() - Offset < Size) ||
Offset + Size > Buf.size())
return object_error::parse_failed; return object_error::parse_failed;
const T *Start = reinterpret_cast<const T *>(base() + Offset); const T *Start = reinterpret_cast<const T *>(base() + Offset);
return makeArrayRef(Start, Size / sizeof(T)); return makeArrayRef(Start, Size / sizeof(T));
} }
template <class ELFT> template <class ELFT>
ErrorOr<ArrayRef<uint8_t>> ErrorOr<ArrayRef<uint8_t>>
▲ Show 20 Lines • Show All 243 Lines • Show Last 20 Lines

test/Object/Inputs/invalid-section-size2.elf

  • This is a binary file.
PropertyOld ValueNew Value
svn:mime-type nullapplication/octet-stream
\ No newline at end of property

test/Object/invalid.test

Show First 20 Lines • Show All 58 Lines • ▼ Show 20 Lines
RUN: FileCheck --check-prefix=INVALID-EXT-SYMTAB-INDEX %s RUN: FileCheck --check-prefix=INVALID-EXT-SYMTAB-INDEX %s
INVALID-EXT-SYMTAB-INDEX: Invalid symbol table index INVALID-EXT-SYMTAB-INDEX: Invalid symbol table index
RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-i386 2>&1 | \ RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-i386 2>&1 | \
RUN: FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s RUN: FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s
RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-x86-64 2>&1 | \ RUN: not llvm-readobj -r %p/Inputs/invalid-relocation-sec-sh_offset.elf-x86-64 2>&1 | \
RUN: FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s RUN: FileCheck --check-prefix=INVALID-RELOC-SH-OFFSET %s
INVALID-RELOC-SH-OFFSET: Invalid data was encountered while parsing the file INVALID-RELOC-SH-OFFSET: Invalid data was encountered while parsing the file
RUN: not llvm-readobj -t %p/Inputs/invalid-section-size2.elf 2>&1 | \
RUN: FileCheck --check-prefix=INVALID-SECTION-SIZE2 %s
INVALID-SECTION-SIZE2: Invalid data was encountered while parsing the file.