https://sourceware.org/bugzilla/show_bug.cgi?id=34705
Aaron Merey <amerey at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|UNCONFIRMED |RESOLVED
CC| |amerey at redhat dot com
--- Comment #4 from Aaron Merey <amerey at redhat dot com> ---
Fixed in commit 364419bc1649a35a0a801f032664fd4afbb8406b:
Author: Harshit Kumar <[email protected]>
Date: Sat Oct 3 15:03:18 2026 +0530
unstrip: reject symbol tables whose sh_size is below sh_entsize
Three sites compute a symbol count as `sh_size / sh_entsize` or subtract
one from it. The existing guards rejected only `sh_entsize == 0`, so a
section that declares `sh_size < sh_entsize` truncates the quotient to
zero and the subtraction wraps. Both fields come straight from the input
ELF.
copy_elided_sections():
In the symbol merge path, `stripped_nsym - 1 + unstripped_nsym - 1` wraps
if either `stripped_nsym == 0` or `unstripped_nsym == 0`.
When `unstripped_nsym == 0`, `total_syms` is under-allocated for
`stripped_nsym - 2` elements and collect_symbols() writes past the end
of the allocation.
When `stripped_nsym == 0`, `&symbols[stripped_nsym - 1]` passes an
underflowed pointer (&symbols[SIZE_MAX]) to collect_symbols(), which
performs
out-of-bounds heap writes.
Additionally, the earlier section copy loop at line 1782 rejected only
`shdr_mem.sh_entsize == 0`, allowing malformed SYMTAB/DYNSYM sections from
the stripped file to propagate.
add_new_section_symbols():
`size_t symndx_map[nsym - 1]` declared a VLA with SIZE_MAX elements when
`nsym == 0`.
Fix the guards at all sites so the quotient can never be zero. Add a
regression test covering malformed stripped and unstripped symbol tables.
* src/unstrip.c (add_new_section_symbols): Reject symbol table
when sh_size < sh_entsize.
(copy_elided_sections): Likewise for stripped and unstripped
symbol tables.
* tests/run-unstrip-symtab-count.sh: New test script.
* tests/testfile-unstrip-symtab0.debug.bz2: New test file.
* tests/testfile-unstrip-symtab0.stripped.bz2: Likewise.
* tests/testfile-unstrip-symtab1.debug.bz2: Likewise.
* tests/testfile-unstrip-symtab1.stripped.bz2: Likewise.
* tests/Makefile.am (TESTS): Add run-unstrip-symtab-count.sh.
(EXTRA_DIST): Add new test script and bz2 files.
Signed-off-by: Harshit Kumar <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.
