Skip to content

Commit d9ae096

Browse files
Abseil Teamcopybara-github
authored andcommitted
absl: fix potential int overflow in ELF reading
Both e_shentsize and e_shstrndx are uint16, so the product elf_header.e_shentsize * elf_header.e_shstrndx can overflow the promoted type int (MAX_UINT16 * MAX_UINT16 > MAX_INT), which is undefined behavior. Not sure if it can affect any real cases or not, though. Cast e_shentsize to loff_t instead of e_shoff. This makes both multiplication and addition to use loff_t type. PiperOrigin-RevId: 511254775 Change-Id: I39c493bfb539cca6742aae807c50718d31e7c001
1 parent bd624d9 commit d9ae096

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

absl/debugging/symbolize_elf.inc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,11 @@ bool ForEachSection(int fd,
532532
return false;
533533
}
534534

535+
// Technically it can be larger, but in practice this never happens.
536+
if (elf_header.e_shentsize != sizeof(ElfW(Shdr))) {
537+
return false;
538+
}
539+
535540
ElfW(Shdr) shstrtab;
536541
off_t shstrtab_offset = static_cast<off_t>(elf_header.e_shoff) +
537542
elf_header.e_shentsize * elf_header.e_shstrndx;
@@ -584,6 +589,11 @@ bool GetSectionHeaderByName(int fd, const char *name, size_t name_len,
584589
return false;
585590
}
586591

592+
// Technically it can be larger, but in practice this never happens.
593+
if (elf_header.e_shentsize != sizeof(ElfW(Shdr))) {
594+
return false;
595+
}
596+
587597
ElfW(Shdr) shstrtab;
588598
off_t shstrtab_offset = static_cast<off_t>(elf_header.e_shoff) +
589599
elf_header.e_shentsize * elf_header.e_shstrndx;

0 commit comments

Comments
 (0)