bfd/ 2005-05-25 Jakub Jelinek * elfcode.h (elf_object_p): Fail if e_shoff != 0, e_shnum == 0 and first shdr has sh_size == 0. Fail if e_shnum is large to cause arithmetic overflow when allocating the i_shdr array. Sanity check sh_link and sh_info fields. Fix e_shstrndx sanity check. 2005-05-18 H.J. Lu * elf.c (group_signature): Check if the symbol table section is correct. 2005-05-17 Tavis Ormandy * elf.c (bfd_section_from_shdr): Add sanity check when parsing dynamic sections. 2005-05-09 Alan Modra * elfcode.h (elf_object_p): Add more sanity checks on elf header. binutils/ 2005-05-24 H.J. Lu * readelf.c (process_section_groups): Check if the section member index is valid. --- bfd/elf.c.jj 2005-02-07 14:42:44.000000000 -0500 +++ bfd/elf.c 2005-05-25 09:51:36.000000000 -0400 @@ -443,8 +443,11 @@ group_signature (bfd *abfd, Elf_Internal Elf_External_Sym_Shndx eshndx; Elf_Internal_Sym isym; - /* First we need to ensure the symbol table is available. */ - if (! bfd_section_from_shdr (abfd, ghdr->sh_link)) + /* First we need to ensure the symbol table is available. Make sure + that it is a symbol table section. */ + hdr = elf_elfsections (abfd) [ghdr->sh_link]; + if (hdr->sh_type != SHT_SYMTAB + || ! bfd_section_from_shdr (abfd, ghdr->sh_link)) return NULL; /* Go read the symbol. */ @@ -1755,6 +1758,9 @@ bfd_section_from_shdr (bfd *abfd, unsign case SHT_DYNAMIC: /* Dynamic linking information. */ if (! _bfd_elf_make_section_from_shdr (abfd, hdr, name)) return FALSE; + if (hdr->sh_link > elf_numsections (abfd) + || elf_elfsections (abfd)[hdr->sh_link] == NULL) + return FALSE; if (elf_elfsections (abfd)[hdr->sh_link]->sh_type != SHT_STRTAB) { Elf_Internal_Shdr *dynsymhdr; --- bfd/elfcode.h.jj 2005-02-07 14:42:44.000000000 -0500 +++ bfd/elfcode.h 2005-05-25 13:09:21.000000000 -0400 @@ -33,7 +33,7 @@ Foundation, Inc., 59 Temple Place - Suit /* Problems and other issues to resolve. (1) BFD expects there to be some fixed number of "sections" in - the object file. I.E. there is a "section_count" variable in the + the object file. I.E. there is a "section_count" variable in the bfd structure which contains the number of sections. However, ELF supports multiple "views" of a file. In particular, with current implementations, executable files typically have two tables, a @@ -612,8 +612,13 @@ elf_object_p (bfd *abfd) if (i_ehdrp->e_shoff != 0) { + bfd_signed_vma where = i_ehdrp->e_shoff; + + if (where != (file_ptr) where) + goto got_wrong_format_error; + /* Seek to the section header table in the file. */ - if (bfd_seek (abfd, (file_ptr) i_ehdrp->e_shoff, SEEK_SET) != 0) + if (bfd_seek (abfd, (file_ptr) where, SEEK_SET) != 0) goto got_no_match; /* Read the first section header at index 0, and convert to internal @@ -625,11 +630,46 @@ elf_object_p (bfd *abfd) /* If the section count is zero, the actual count is in the first section header. */ if (i_ehdrp->e_shnum == SHN_UNDEF) - i_ehdrp->e_shnum = i_shdr.sh_size; + { + i_ehdrp->e_shnum = i_shdr.sh_size; + if (i_ehdrp->e_shnum != i_shdr.sh_size + || i_ehdrp->e_shnum == 0) + goto got_wrong_format_error; + } /* And similarly for the string table index. */ if (i_ehdrp->e_shstrndx == SHN_XINDEX) - i_ehdrp->e_shstrndx = i_shdr.sh_link; + { + i_ehdrp->e_shstrndx = i_shdr.sh_link; + if (i_ehdrp->e_shstrndx != i_shdr.sh_link) + goto got_wrong_format_error; + } + + /* Sanity check that we can read all of the section headers. + It ought to be good enough to just read the last one. */ + if (i_ehdrp->e_shnum != 1) + { + /* Check that we don't have a totally silly number of sections. */ + if (i_ehdrp->e_shnum > (unsigned int) -1 / sizeof (x_shdr) + || i_ehdrp->e_shnum > (unsigned int) -1 / sizeof (i_shdr)) + goto got_wrong_format_error; + + where += (i_ehdrp->e_shnum - 1) * sizeof (x_shdr); + if (where != (file_ptr) where) + goto got_wrong_format_error; + if ((bfd_size_type) where <= i_ehdrp->e_shoff) + goto got_wrong_format_error; + + if (bfd_seek (abfd, (file_ptr) where, SEEK_SET) != 0) + goto got_no_match; + if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) + goto got_no_match; + + /* Back to where we were. */ + where = i_ehdrp->e_shoff + sizeof (x_shdr); + if (bfd_seek (abfd, (file_ptr) where, SEEK_SET) != 0) + goto got_no_match; + } } /* Allocate space for a copy of the section header table in @@ -673,6 +713,20 @@ elf_object_p (bfd *abfd) goto got_no_match; elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex); + /* Sanity check sh_link and sh_info. */ + if (i_shdrp[shindex].sh_link >= num_sec + || (i_shdrp[shindex].sh_link >= SHN_LORESERVE + && i_shdrp[shindex].sh_link <= SHN_HIRESERVE)) + goto got_wrong_format_error; + + if (((i_shdrp[shindex].sh_flags & SHF_INFO_LINK) + || i_shdrp[shindex].sh_type == SHT_RELA + || i_shdrp[shindex].sh_type == SHT_REL) + && (i_shdrp[shindex].sh_info >= num_sec + || (i_shdrp[shindex].sh_info >= SHN_LORESERVE + && i_shdrp[shindex].sh_info <= SHN_HIRESERVE))) + goto got_wrong_format_error; + /* If the section is loaded, but not page aligned, clear D_PAGED. */ if (i_shdrp[shindex].sh_size != 0 @@ -685,6 +739,17 @@ elf_object_p (bfd *abfd) } } + /* A further sanity check. */ + if (i_ehdrp->e_shnum != 0) + { + if (i_ehdrp->e_shstrndx >= elf_numsections (abfd) + || (i_ehdrp->e_shstrndx >= SHN_LORESERVE + && i_ehdrp->e_shstrndx <= SHN_HIRESERVE)) + goto got_wrong_format_error; + } + else if (i_ehdrp->e_shstrndx != 0) + goto got_wrong_format_error; + /* Read in the program headers. */ if (i_ehdrp->e_phnum == 0) elf_tdata (abfd)->phdr = NULL; @@ -1042,7 +1107,7 @@ elf_slurp_symbol_table (bfd *abfd, asymb symcount); /* Slurp in the symbols without the version information, - since that is more helpful than just quitting. */ + since that is more helpful than just quitting. */ verhdr = NULL; } @@ -1107,7 +1172,7 @@ elf_slurp_symbol_table (bfd *abfd, asymb sym->symbol.section = bfd_abs_section_ptr; /* If this is a relocatable file, then the symbol value is - already section relative. */ + already section relative. */ if ((abfd->flags & (EXEC_P | DYNAMIC)) != 0) sym->symbol.value -= sym->symbol.section->vma; --- binutils/readelf.c.jj 2005-02-18 01:14:30.000000000 -0500 +++ binutils/readelf.c 2005-05-25 13:09:39.000000000 -0400 @@ -4067,6 +4067,19 @@ process_section_groups (FILE *file) entry = byte_get (indices, 4); indices += 4; + if (entry >= elf_header.e_shnum) + { + error (_("section [%5u] in group section [%5u] > maximum section [%5u]\n"), + entry, i, elf_header.e_shnum - 1); + continue; + } + else if (entry >= SHN_LORESERVE && entry <= SHN_HIRESERVE) + { + error (_("invalid section [%5u] in group section [%5u]\n"), + entry, i); + continue; + } + if (section_headers_groups [SECTION_HEADER_INDEX (entry)] != NULL) {