llvm-objdump: printDynamicSection() out-of-bounds read #86612
Comments
|
@llvm/issue-subscribers-tools-llvm-objdump Author: Ed Maste (emaste)
Reported against FreeBSD at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277885, with attached ELF reproducer.
|
|
Possible duplicate of #85568? Could you check against HEAD, please? |
|
Think this should work: --- a/llvm/tools/llvm-objdump/ELFDump.cpp
+++ b/llvm/tools/llvm-objdump/ELFDump.cpp
@@ -233,7 +233,13 @@ template <class ELFT> void ELFDumper<ELFT>::printDynamicSection() {
Expected<StringRef> StrTabOrErr = getDynamicStrTab(Elf);
if (StrTabOrErr) {
const char *Data = StrTabOrErr.get().data();
- outs() << (Data + Dyn.d_un.d_val) << "\n";
+ const auto SecSize =
+ unwrapOrError(Elf.getSection(ELF::SHT_DYNAMIC), Obj.getFileName())
+ ->sh_size;
+ if (Dyn.d_un.d_val > SecSize)
+ reportWarning("string table offset out-of-bound", Obj.getFileName());
+ else
+ outs() << Data + Dyn.d_un.d_val << "\n";
continue;
}
reportWarning(toString(StrTabOrErr.takeError()), Obj.getFileName()); |
These were submitted as separate FreeBSD issues, and indeed it is still reproducible at bf4fc00 and no crash with @antoniofrighetto's patch: |
artagnon
added a commit
to artagnon/llvm-project
that referenced
this issue
Apr 3, 2024
When reading the dynamic string table, llvm-objdump used to crash if the ELF was malformed, due to an erroneous consumption of error status. Instead, propogate the error status to the caller, fixing the crash, and printing a warning. Fixes llvm#86612.
|
llvm/tools/llvm-objdump/ELFDump.cpp:70 @artagnon We need a minimal reproduce file. obj2yaml gives a start, but you need to scrub unneeded parts from the YAML file. A test filename like |
cabbaken
added a commit
to cabbaken/llvm-project
that referenced
this issue
Jan 26, 2025
This change make the check of the section size to avoid crashing of llvm-objdump when processing misformated elf file. Signed-off-by: cabbaken <[email protected]>
cabbaken
added a commit
to cabbaken/llvm-project
that referenced
this issue
Jan 26, 2025
This change make the check of the section size to avoid crashing of llvm-objdump when processing misformated elf file. Signed-off-by: cabbaken <[email protected]>
cabbaken
added a commit
to cabbaken/llvm-project
that referenced
this issue
Jan 28, 2025
This change make the check of the section size to avoid crashing of llvm-objdump when processing misformated elf file. Signed-off-by: cabbaken <[email protected]>
cabbaken
added a commit
to cabbaken/llvm-project
that referenced
this issue
Feb 4, 2025
…ng for malformed ELF file(llvm#86612) This change introduces a check for the strtab offset to prevent llvm-objdump from crashing when processing malformed ELF files. Additionally, it modifies how llvm-objdump handles and outputs malformed ELF files with invalid string offsets. More info: https://discourse.llvm.org/t/should-llvm-objdump-objdump-display-actual-corrupted-values-in-malformed-elf-files/84391 Signed-off-by: cabbaken <[email protected]>
I tested the binary file of above link, the cause of the crashing is the huge value of |
cabbaken
added a commit
to cabbaken/llvm-project
that referenced
this issue
Feb 5, 2025
…6612) This change introduces a check for the strtab offset to prevent llvm-objdump from crashing when processing malformed ELF files. Additionally, it modifies how llvm-objdump handles and outputs malformed ELF files with invalid string offsets. More info: https://discourse.llvm.org/t/should-llvm-objdump-objdump-display-actual-corrupted-values-in-malformed-elf-files/84391 Signed-off-by: cabbaken <[email protected]>
MaskRay
pushed a commit
that referenced
this issue
Mar 10, 2025
This change introduces a check for the strtab offset to prevent llvm-objdump from crashing when processing malformed ELF files. It provide a minimal reproduce test for #86612 (comment). Additionally, it modifies how llvm-objdump handles and outputs malformed ELF files with invalid string offsets.(More info: https://discourse.llvm.org/t/should-llvm-objdump-objdump-display-actual-corrupted-values-in-malformed-elf-files/84391) Fixes: #86612 Co-authored-by: James Henderson <[email protected]>
llvm-sync bot
pushed a commit
to arm/arm-toolchain
that referenced
this issue
Mar 10, 2025
…nstr (#125679) This change introduces a check for the strtab offset to prevent llvm-objdump from crashing when processing malformed ELF files. It provide a minimal reproduce test for llvm/llvm-project#86612 (comment). Additionally, it modifies how llvm-objdump handles and outputs malformed ELF files with invalid string offsets.(More info: https://discourse.llvm.org/t/should-llvm-objdump-objdump-display-actual-corrupted-values-in-malformed-elf-files/84391) Fixes: #86612 Co-authored-by: James Henderson <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reported against FreeBSD at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277885, with attached ELF reproducer.
The text was updated successfully, but these errors were encountered: