From 4fc4b601e11110384269c1f8a572c723324a7eb5 Mon Sep 17 00:00:00 2001 From: Paul Pluzhnikov Date: Mon, 13 Nov 2023 22:40:46 +0000 Subject: [PATCH] Fix computations with (potentially) NULL pointer When map_address is NULL, computing map_address+offset is technically undefined behavior, and triggers Clang/LLVM warning when using -fsanitize=pointer-overflow. Fix this by using uintptr_t to perform computations. Signed-off-by: Shahriar "Nafi" Rouf Signed-off-by: Paul Pluzhnikov --- libelf/elf_begin.c | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index fe8c640a..9f8196b6 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -341,15 +341,15 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, { /* This pointer might not be directly usable if the alignment is not sufficient for the architecture. */ - Elf32_Ehdr *ehdr = (Elf32_Ehdr *) ((char *) map_address + offset); + uintptr_t ehdr = (uintptr_t) map_address + offset; /* This is a 32-bit binary. */ if (map_address != NULL && e_ident[EI_DATA] == MY_ELFDATA && (ALLOW_UNALIGNED - || (((uintptr_t) ehdr) & (__alignof__ (Elf32_Ehdr) - 1)) == 0)) + || (ehdr & (__alignof__ (Elf32_Ehdr) - 1)) == 0)) { /* We can use the mmapped memory. */ - elf->state.elf32.ehdr = ehdr; + elf->state.elf32.ehdr = (Elf32_Ehdr *) ehdr; } else { @@ -382,8 +382,7 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, if (map_address != NULL && e_ident[EI_DATA] == MY_ELFDATA && cmd != ELF_C_READ_MMAP /* We need a copy to be able to write. */ && (ALLOW_UNALIGNED - || ((((uintptr_t) ehdr + e_shoff) - & (__alignof__ (Elf32_Shdr) - 1)) == 0))) + || (((ehdr + e_shoff) & (__alignof__ (Elf32_Shdr) - 1)) == 0))) { if (unlikely (scncnt > 0 && e_shoff >= maxsize) || unlikely (maxsize - e_shoff @@ -396,8 +395,7 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, } if (scncnt > 0) - elf->state.elf32.shdr - = (Elf32_Shdr *) ((char *) ehdr + e_shoff); + elf->state.elf32.shdr = (Elf32_Shdr *) (ehdr + e_shoff); for (size_t cnt = 0; cnt < scncnt; ++cnt) { @@ -445,15 +443,15 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, { /* This pointer might not be directly usable if the alignment is not sufficient for the architecture. */ - Elf64_Ehdr *ehdr = (Elf64_Ehdr *) ((char *) map_address + offset); + uintptr_t ehdr = (uintptr_t) map_address + offset; /* This is a 64-bit binary. */ if (map_address != NULL && e_ident[EI_DATA] == MY_ELFDATA && (ALLOW_UNALIGNED - || (((uintptr_t) ehdr) & (__alignof__ (Elf64_Ehdr) - 1)) == 0)) + || (ehdr & (__alignof__ (Elf64_Ehdr) - 1)) == 0)) { /* We can use the mmapped memory. */ - elf->state.elf64.ehdr = ehdr; + elf->state.elf64.ehdr = (Elf64_Ehdr *) ehdr; } else { @@ -486,8 +484,7 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, if (map_address != NULL && e_ident[EI_DATA] == MY_ELFDATA && cmd != ELF_C_READ_MMAP /* We need a copy to be able to write. */ && (ALLOW_UNALIGNED - || ((((uintptr_t) ehdr + e_shoff) - & (__alignof__ (Elf64_Shdr) - 1)) == 0))) + || (((ehdr + e_shoff) & (__alignof__ (Elf64_Shdr) - 1)) == 0))) { if (unlikely (scncnt > 0 && e_shoff >= maxsize) || unlikely (maxsize - e_shoff @@ -495,8 +492,7 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, goto free_and_out; if (scncnt > 0) - elf->state.elf64.shdr - = (Elf64_Shdr *) ((char *) ehdr + e_shoff); + elf->state.elf64.shdr = (Elf64_Shdr *) (ehdr + e_shoff); for (size_t cnt = 0; cnt < scncnt; ++cnt) { -- 2.42.0.869.gea05f2083d-goog