[ELF] - Handle broken size field of compressed sections header.

[grimar]

Summary

Patch fixes issue when 32bit host may have overflow after assigning ch_size to size_t.
Also adds uncompressed section size limit to help in diagnostic of broken inputs.

[davide]

Independently from this patch. Are we really trying to fully support 32-bit hosts? We mmap() the whole set of input which I think very likely causes shortage of VA on 32-bit platforms.

[grimar]

In D25518#568300, @davide wrote:

Independently from this patch. Are we really trying to fully support 32-bit hosts? We mmap() the whole set of input which I think very likely causes shortage of VA on 32-bit platforms.

Do you think we should check if 32 bits host is used to link 64 bit app and just error out before trying to link ?

[ruiu]

Our current policy is essentially to trust file contents but reject silly apparent errors. We are not trying to recover from all possible crashes (and this patch doesn't save the linker from crashing neither -- but instead it makes the linker to kill itself after printing out an error message.) Naturally, there are a lot of places left we can add error checking, but in most places we don't as a policy. When you add a check like this, I think you want to show that why this is special among other possible errors. Otherwise, we'd have tons of error checks in our code base and still the linker crashes for broken inputs.

As to 32-bit hosts, I think we want to support it, because, why not? You cannot create >4GB binary on 32 bit, but as long as it is smaller than a few gigs, LLD should work fine.

[grimar]

In D25518#568396, @ruiu wrote:

When you add a check like this, I think you want to show that why this is special among other possible errors. Otherwise, we'd have tons of error checks in our code base and still the linker crashes for broken inputs.

This error check at least special for 32 bit hosts. As if overflow happens here, user will get probably get error "error uncompressing section" instead of real reason "uncompressed section size is too large". Isn't that useful ?

[grimar]

Depricated.

ELF/InputSection.cpp

template <class ELFT> void InputSectionBase<ELFT>::uncompress() {
   if (Data.size() < sizeof(Elf_Chdr))
     fatal("corrupt compressed section");
 
   auto *Hdr = reinterpret_cast<const Elf_Chdr *>(Data.data());
   Data = Data.slice(sizeof(Elf_Chdr));
 
   if (Hdr->ch_type != ELFCOMPRESS_ZLIB)
     fatal(getName(this) + ": unsupported compression type");
+  // We check that uncompressed section size is not greater than 2^40
+  // because it seems to be reasonable limit to protect from broken inputs.
+  if (Hdr->ch_size > SIZE_MAX || Hdr->ch_size > 0x10000000000)
+    fatal(getName(this) + ": uncompressed section size is too large");
 
   StringRef Buf((const char *)Data.data(), Data.size());
   size_t UncompressedDataSize = Hdr->ch_size;
   UncompressedData.reset(new char[UncompressedDataSize]);
   if (zlib::uncompress(Buf, UncompressedData.get(), UncompressedDataSize) !=
       zlib::StatusOK)
     fatal(getName(this) + ": error uncompressing section");
   Data = ArrayRef<uint8_t>((uint8_t *)UncompressedData.get(),

test/ELF/invalid/too-large-compressed-sec.s

+# REQUIRES: x86
+
+## too-large-compressed-sec.elf contains compressed section
+## with broken header containing huge uncompressed section size value.
+# RUN: not ld.lld %S/Inputs/common-symbol-alignment.elf \
+# RUN:   -o %t 2>&1 | FileCheck %s
+# CHECK: uncompressed section size is too large