[obj2yaml] - Dump the content of a broken GNU hash table properly.

[grimar]

Summary

When something is wrong with the GNU hash table header we dump
its context as a raw data.

Currently we have the calculation overflow issue and it is possible to
bypass the validation we have (and crash).

The patch fixes it.

[MaskRay]

Looks great!

llvm/test/tools/obj2yaml/ELF/gnu-hash-section.yaml

126

NBuckets = 0xFFFFFFFF is incorrect. The result will cause 32-bit unsigned overflows if we keep intermediate expressions uint32_t.

llvm/test/tools/obj2yaml/ELF/gnu-hash-section.yaml

 # INVALID-NEXT:     SymNdx:      0x0
 # INVALID-NEXT:     Shift2:      0x0
 # INVALID-NEXT:   BloomFilter: [ ]
 # INVALID-NEXT:   HashBuckets: [ ]
 # INVALID-NEXT:   HashValues:  [ ]
 # INVALID-NEXT: - Name:        .gnu.hash.broken.maskwords
 # INVALID-NEXT:   Type:        SHT_GNU_HASH
 # INVALID-NEXT:   Content:     '00000000000000000100000000000000'
-# INVALID-NEXT: - Name:        .gnu.hash.broken.nbuckets
+# INVALID-NEXT: - Name:        .gnu.hash.broken.nbuckets.a
 # INVALID-NEXT:   Type:        SHT_GNU_HASH
 # INVALID-NEXT:   Content:     '01000000000000000000000000000000'
+# INVALID-NEXT: - Name:        .gnu.hash.broken.nbuckets.b
+# INVALID-NEXT:   Type:        SHT_GNU_HASH
+# INVALID-NEXT:   Content:     FFFFFFFF000000000100000000000000{{$}}
 # INVALID-NEXT: - Name:        .gnu.hash.hashvalues.ok
 # INVALID-NEXT:   Type:        SHT_GNU_HASH
 # INVALID-NEXT:   Header:
 # INVALID-NEXT:     SymNdx:      0x0
 # INVALID-NEXT:     Shift2:      0x0
 # INVALID-NEXT:   BloomFilter: [ ]
 # INVALID-NEXT:   HashBuckets: [ ]
 # INVALID-NEXT:   HashValues:  [ 0x0 ]
- Name:  .gnu.hash.broken.maskwords
     Header:
       SymNdx: 0x0
       Shift2: 0x0
       MaskWords: 0x1
       NBuckets:  0x0
     BloomFilter: []
     HashBuckets: []
     HashValues:  []
-## Case 4: NBuckets field is broken, it says that the number of entries
+## Case 4(a): NBuckets field is broken, it says that the number of entries
 ## in the hash buckets is 1, but it is empty.
-  - Name:  .gnu.hash.broken.nbuckets
+  - Name:  .gnu.hash.broken.nbuckets.a
     Type:  SHT_GNU_HASH
     Header:
       SymNdx: 0x0
       Shift2: 0x0
       MaskWords: 0x0
       NBuckets:  0x1
     BloomFilter: []
     HashBuckets: []
     HashValues:  []
+## Case 4(b): NBuckets = 0xFFFFFFFF is incorrect. The result will cause 32-bit
+## unsigned overflows if we keep intermediate expressions uint32_t.
+  - Name:  .gnu.hash.broken.nbuckets.b
+    Type:  SHT_GNU_HASH
+    Header:
+      SymNdx: 0x0
+      Shift2: 0x0
+      MaskWords: 0x1
+      NBuckets:  0xFFFFFFFF
+    BloomFilter: []
+    HashBuckets: []
+    HashValues:  []
 ## Case 5: Check that we use the various properties to dump the data when it
 ## has a size that is a multiple of 4, but fallback to dumping the whole section
 ## using the "Content" property otherwise.
   - Name:  .gnu.hash.hashvalues.ok
     Type:  SHT_GNU_HASH
     Content: "0000000000000000000000000000000000000000"
   - Name:  .gnu.hash.hashvalues.fail
     Type:  SHT_GNU_HASH
     Content: "000000000000000000000000000000000000000000"

llvm/tools/obj2yaml/elf2yaml.cpp

if (!ContentOrErr)
     return ContentOrErr.takeError();
 
   unsigned AddrSize = ELFT::Is64Bits ? 8 : 4;
   ArrayRef<uint8_t> Content = *ContentOrErr;
   DataExtractor Data(Content, Obj.isLE(), AddrSize);
 
   ELFYAML::GnuHashHeader Header;
   DataExtractor::Cursor Cur(0);
-  uint32_t NBuckets = Data.getU32(Cur);
+  uint64_t NBuckets = Data.getU32(Cur);
   Header.SymNdx = Data.getU32(Cur);
-  uint32_t MaskWords = Data.getU32(Cur);
+  uint64_t MaskWords = Data.getU32(Cur);
   Header.Shift2 = Data.getU32(Cur);
 
   // Set just the raw binary content if we were unable to read the header
   // or when the section data is truncated or malformed.
   uint64_t Size = Data.getData().size() - Cur.tell();
   if (!Cur || (Size < MaskWords * AddrSize + NBuckets * 4) ||
       (Size % 4 != 0)) {
     consumeError(Cur.takeError());