Magellan Linux

Contents of /trunk/elfutils/patches/elfutils-0.108-robustify3.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 144 - (show annotations) (download)
Tue May 8 20:06:05 2007 UTC (17 years, 5 months ago) by niro
File size: 67237 byte(s)
-import

1 src/
2 2005-06-09 Roland McGrath <roland@redhat.com>
3
4 * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
5 (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
6 (handle_scngrp): Check for bogus sh_info.
7
8 * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
9 st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
10 Don't use assert on input values, instead bail with "illformed" error.
11
12 2005-05-17 Jakub Jelinek <jakub@redhat.com>
13
14 libelf/
15 * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
16 table fits into object's bounds.
17 * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
18 elf->map_address. Check if first section header fits into object's
19 bounds.
20 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Fix comment pasto.
21 Check if section header table fits into object's bounds.
22 * elf_begin.c (get_shnum): Fail if maxsize is smaller than ELF headers.
23 Ensure first section header fits into object's bounds.
24 (file_read_elf): Make sure scncnt is small enough to allocate both
25 ElfXX_Shdr and Elf_Scn array. Make sure section and program header
26 tables fit into object's bounds. Avoid memory leak on failure.
27
28 src/
29 * elflint.c (check_hash): Don't check entries beyond end of section.
30 (check_note): Don't crash if gelf_rawchunk fails.
31 (section_name): Return <invalid> if gelf_getshdr returns NULL.
32
33 2005-05-14 Jakub Jelinek <jakub@redhat.com>
34
35 libelf/
36 * libelfP.h (INVALID_NDX): Define.
37 * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
38 * gelf_getlib.c (gelf_getlib): Likewise.
39 * gelf_getmove.c (gelf_getmove): Likewise.
40 * gelf_getrel.c (gelf_getrel): Likewise.
41 * gelf_getrela.c (gelf_getrela): Likewise.
42 * gelf_getsym.c (gelf_getsym): Likewise.
43 * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
44 * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
45 * gelf_getversym.c (gelf_getversym): Likewise.
46 * gelf_update_dyn.c (gelf_update_dyn): Likewise.
47 * gelf_update_lib.c (gelf_update_lib): Likewise.
48 * gelf_update_move.c (gelf_update_move): Likewise.
49 * gelf_update_rel.c (gelf_update_rel): Likewise.
50 * gelf_update_rela.c (gelf_update_rela): Likewise.
51 * gelf_update_sym.c (gelf_update_sym): Likewise.
52 * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
53 * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
54 * gelf_update_versym.c (gelf_update_versym): Likewise.
55 * elf_newscn.c (elf_newscn): Check for overflow.
56 * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
57 (__elfw2(LIBELFBITS,updatefile)): Likewise.
58 * elf_begin.c (file_read_elf): Likewise.
59 * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
60 * elf_getarsym.c (elf_getarsym): Likewise.
61 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
62 src/
63 * elflint.c (section_name): Return "<invalid>" instead of
64 crashing on invalid section name.
65 (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
66 check_symtab_shndx, check_hash, check_versym): Robustify.
67
68 --- elfutils-0.108/libelf/gelf_getrel.c.jj 2004-01-05 21:45:05.000000000 +0100
69 +++ elfutils-0.108/libelf/gelf_getrel.c 2005-05-14 01:31:25.000000000 +0200
70 @@ -1,5 +1,5 @@
71 /* Get REL relocation information at given index.
72 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
73 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
74 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
75
76 This program is free software; you can redistribute it and/or modify
77 @@ -38,12 +38,6 @@ gelf_getrel (data, ndx, dst)
78 if (data_scn == NULL)
79 return NULL;
80
81 - if (unlikely (ndx < 0))
82 - {
83 - __libelf_seterrno (ELF_E_INVALID_INDEX);
84 - return NULL;
85 - }
86 -
87 if (unlikely (data_scn->d.d_type != ELF_T_REL))
88 {
89 __libelf_seterrno (ELF_E_INVALID_HANDLE);
90 @@ -60,7 +54,8 @@ gelf_getrel (data, ndx, dst)
91 if (scn->elf->class == ELFCLASS32)
92 {
93 /* We have to convert the data. */
94 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
95 + if (INVALID_NDX (ndx, Elf32_Rel)
96 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
97 {
98 __libelf_seterrno (ELF_E_INVALID_INDEX);
99 result = NULL;
100 @@ -80,7 +75,8 @@ gelf_getrel (data, ndx, dst)
101 {
102 /* Simply copy the data after we made sure we are actually getting
103 correct data. */
104 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
105 + if (INVALID_NDX (ndx, Elf64_Rel)
106 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
107 {
108 __libelf_seterrno (ELF_E_INVALID_INDEX);
109 result = NULL;
110 --- elfutils-0.108/libelf/gelf_getsym.c.jj 2004-01-05 21:45:05.000000000 +0100
111 +++ elfutils-0.108/libelf/gelf_getsym.c 2005-05-14 01:31:25.000000000 +0200
112 @@ -1,5 +1,5 @@
113 /* Get symbol information from symbol table at the given index.
114 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
115 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
116 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
117
118 This program is free software; you can redistribute it and/or modify
119 @@ -57,7 +57,8 @@ gelf_getsym (data, ndx, dst)
120 table entries has to be adopted. The user better has provided
121 a buffer where we can store the information. While copying the
122 data we are converting the format. */
123 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
124 + if (INVALID_NDX (ndx, Elf32_Sym)
125 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
126 {
127 __libelf_seterrno (ELF_E_INVALID_INDEX);
128 goto out;
129 @@ -86,7 +87,8 @@ gelf_getsym (data, ndx, dst)
130
131 /* The data is already in the correct form. Just make sure the
132 index is OK. */
133 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
134 + if (INVALID_NDX (ndx, GElf_Sym)
135 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
136 {
137 __libelf_seterrno (ELF_E_INVALID_INDEX);
138 goto out;
139 --- elfutils-0.108/libelf/gelf_update_sym.c.jj 2004-01-05 21:45:05.000000000 +0100
140 +++ elfutils-0.108/libelf/gelf_update_sym.c 2005-05-14 01:31:25.000000000 +0200
141 @@ -1,5 +1,5 @@
142 /* Update symbol information in symbol table at the given index.
143 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
144 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
145 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
146
147 This program is free software; you can redistribute it and/or modify
148 @@ -39,12 +39,6 @@ gelf_update_sym (data, ndx, src)
149 if (data == NULL)
150 return 0;
151
152 - if (unlikely (ndx < 0))
153 - {
154 - __libelf_seterrno (ELF_E_INVALID_INDEX);
155 - return 0;
156 - }
157 -
158 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
159 {
160 /* The type of the data better should match. */
161 @@ -69,7 +63,8 @@ gelf_update_sym (data, ndx, src)
162 }
163
164 /* Check whether we have to resize the data buffer. */
165 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
166 + if (INVALID_NDX (ndx, Elf32_Sym)
167 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
168 {
169 __libelf_seterrno (ELF_E_INVALID_INDEX);
170 goto out;
171 @@ -92,7 +87,8 @@ gelf_update_sym (data, ndx, src)
172 else
173 {
174 /* Check whether we have to resize the data buffer. */
175 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
176 + if (INVALID_NDX (ndx, Elf64_Sym)
177 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
178 {
179 __libelf_seterrno (ELF_E_INVALID_INDEX);
180 goto out;
181 --- elfutils-0.108/libelf/gelf_getrela.c.jj 2004-01-05 21:45:05.000000000 +0100
182 +++ elfutils-0.108/libelf/gelf_getrela.c 2005-05-14 01:31:25.000000000 +0200
183 @@ -1,5 +1,5 @@
184 /* Get RELA relocation information at given index.
185 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
186 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
187 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
188
189 This program is free software; you can redistribute it and/or modify
190 @@ -38,12 +38,6 @@ gelf_getrela (data, ndx, dst)
191 if (data_scn == NULL)
192 return NULL;
193
194 - if (unlikely (ndx < 0))
195 - {
196 - __libelf_seterrno (ELF_E_INVALID_INDEX);
197 - return NULL;
198 - }
199 -
200 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
201 {
202 __libelf_seterrno (ELF_E_INVALID_HANDLE);
203 @@ -60,7 +54,8 @@ gelf_getrela (data, ndx, dst)
204 if (scn->elf->class == ELFCLASS32)
205 {
206 /* We have to convert the data. */
207 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
208 + if (INVALID_NDX (ndx, Elf32_Rela)
209 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
210 {
211 __libelf_seterrno (ELF_E_INVALID_INDEX);
212 result = NULL;
213 @@ -81,7 +76,8 @@ gelf_getrela (data, ndx, dst)
214 {
215 /* Simply copy the data after we made sure we are actually getting
216 correct data. */
217 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
218 + if (INVALID_NDX (ndx, Elf64_Rela)
219 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
220 {
221 __libelf_seterrno (ELF_E_INVALID_INDEX);
222 result = NULL;
223 --- elfutils-0.108/libelf/gelf_update_syminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
224 +++ elfutils-0.108/libelf/gelf_update_syminfo.c 2005-05-14 01:31:25.000000000 +0200
225 @@ -1,5 +1,5 @@
226 /* Update additional symbol information in symbol table at the given index.
227 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
228 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
229 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
230
231 This program is free software; you can redistribute it and/or modify
232 @@ -39,12 +39,6 @@ gelf_update_syminfo (data, ndx, src)
233 if (data == NULL)
234 return 0;
235
236 - if (unlikely (ndx < 0))
237 - {
238 - __libelf_seterrno (ELF_E_INVALID_INDEX);
239 - return 0;
240 - }
241 -
242 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
243 {
244 /* The type of the data better should match. */
245 @@ -60,7 +54,8 @@ gelf_update_syminfo (data, ndx, src)
246 rwlock_wrlock (scn->elf->lock);
247
248 /* Check whether we have to resize the data buffer. */
249 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
250 + if (INVALID_NDX (ndx, GElf_Syminfo)
251 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
252 {
253 __libelf_seterrno (ELF_E_INVALID_INDEX);
254 goto out;
255 --- elfutils-0.108/libelf/gelf_getsyminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
256 +++ elfutils-0.108/libelf/gelf_getsyminfo.c 2005-05-14 01:31:25.000000000 +0200
257 @@ -1,5 +1,5 @@
258 /* Get additional symbol information from symbol table at the given index.
259 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
260 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
261 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
262
263 This program is free software; you can redistribute it and/or modify
264 @@ -51,7 +51,8 @@ gelf_getsyminfo (data, ndx, dst)
265
266 /* The data is already in the correct form. Just make sure the
267 index is OK. */
268 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
269 + if (INVALID_NDX (ndx, GElf_Syminfo)
270 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
271 {
272 __libelf_seterrno (ELF_E_INVALID_INDEX);
273 goto out;
274 --- elfutils-0.108/libelf/elf_newscn.c.jj 2004-01-05 21:45:05.000000000 +0100
275 +++ elfutils-0.108/libelf/elf_newscn.c 2005-05-14 01:38:35.000000000 +0200
276 @@ -1,5 +1,5 @@
277 /* Append new section.
278 - Copyright (C) 1998, 1999, 2000, 2001, 2002 Red Hat, Inc.
279 + Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
280 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
281
282 This program is free software; you can redistribute it and/or modify
283 @@ -71,13 +71,21 @@ elf_newscn (elf)
284 else
285 {
286 /* We must allocate a new element. */
287 - Elf_ScnList *newp;
288 + Elf_ScnList *newp = NULL;
289
290 assert (elf->state.elf.scnincr > 0);
291
292 - newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
293 - + ((elf->state.elf.scnincr *= 2)
294 - * sizeof (Elf_Scn)), 1);
295 + if (
296 +#if SIZE_MAX <= 4294967295U
297 + likely (elf->state.elf.scnincr
298 + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
299 +#else
300 + 1
301 +#endif
302 + )
303 + newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
304 + + ((elf->state.elf.scnincr *= 2)
305 + * sizeof (Elf_Scn)), 1);
306 if (newp == NULL)
307 {
308 __libelf_seterrno (ELF_E_NOMEM);
309 --- elfutils-0.108/libelf/gelf_update_lib.c.jj 2004-01-23 19:23:03.000000000 +0100
310 +++ elfutils-0.108/libelf/gelf_update_lib.c 2005-05-14 01:31:25.000000000 +0200
311 @@ -1,5 +1,5 @@
312 /* Update library in table at the given index.
313 - Copyright (C) 2004 Red Hat, Inc.
314 + Copyright (C) 2004, 2005 Red Hat, Inc.
315 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
316
317 This program is free software; you can redistribute it and/or modify
318 @@ -35,12 +35,6 @@ gelf_update_lib (data, ndx, src)
319 if (data == NULL)
320 return 0;
321
322 - if (unlikely (ndx < 0))
323 - {
324 - __libelf_seterrno (ELF_E_INVALID_INDEX);
325 - return 0;
326 - }
327 -
328 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
329 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
330 {
331 @@ -54,7 +48,8 @@ gelf_update_lib (data, ndx, src)
332
333 /* Check whether we have to resize the data buffer. */
334 int result = 0;
335 - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
336 + if (INVALID_NDX (ndx, Elf64_Lib)
337 + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
338 __libelf_seterrno (ELF_E_INVALID_INDEX);
339 else
340 {
341 --- elfutils-0.108/libelf/gelf_getmove.c.jj 2004-01-05 21:45:05.000000000 +0100
342 +++ elfutils-0.108/libelf/gelf_getmove.c 2005-05-14 01:31:25.000000000 +0200
343 @@ -1,5 +1,5 @@
344 /* Get move structure at the given index.
345 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
346 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
347 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
348
349 This program is free software; you can redistribute it and/or modify
350 @@ -50,7 +50,8 @@ gelf_getmove (data, ndx, dst)
351
352 /* The data is already in the correct form. Just make sure the
353 index is OK. */
354 - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
355 + if (INVALID_NDX (ndx, GElf_Move)
356 + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
357 {
358 __libelf_seterrno (ELF_E_INVALID_INDEX);
359 goto out;
360 --- elfutils-0.108/libelf/elf32_updatefile.c.jj 2005-02-06 10:14:52.000000000 +0100
361 +++ elfutils-0.108/libelf/elf32_updatefile.c 2005-05-14 00:45:03.000000000 +0200
362 @@ -164,6 +164,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf
363 /* Write all the sections. Well, only those which are modified. */
364 if (shnum > 0)
365 {
366 + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
367 + return 1;
368 +
369 ElfW2(LIBELFBITS,Shdr) *shdr_dest;
370 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
371 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
372 @@ -468,6 +471,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf
373 /* Write all the sections. Well, only those which are modified. */
374 if (shnum > 0)
375 {
376 + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
377 + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
378 + return 1;
379 +
380 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
381 #if EV_NUM != 2
382 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
383 --- elfutils-0.108/libelf/gelf_getsymshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
384 +++ elfutils-0.108/libelf/gelf_getsymshndx.c 2005-05-14 01:31:25.000000000 +0200
385 @@ -1,6 +1,6 @@
386 /* Get symbol information and separate section index from symbol table
387 at the given index.
388 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
389 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
390 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
391
392 This program is free software; you can redistribute it and/or modify
393 @@ -57,7 +57,9 @@ gelf_getsymshndx (symdata, shndxdata, nd
394 section index table. */
395 if (likely (shndxdata_scn != NULL))
396 {
397 - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
398 + if (INVALID_NDX (ndx, Elf32_Word)
399 + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
400 + > shndxdata_scn->d.d_size))
401 {
402 __libelf_seterrno (ELF_E_INVALID_INDEX);
403 goto out;
404 @@ -77,7 +79,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
405 table entries has to be adopted. The user better has provided
406 a buffer where we can store the information. While copying the
407 data we are converting the format. */
408 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
409 + if (INVALID_NDX (ndx, Elf32_Sym)
410 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
411 {
412 __libelf_seterrno (ELF_E_INVALID_INDEX);
413 goto out;
414 @@ -106,7 +109,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
415
416 /* The data is already in the correct form. Just make sure the
417 index is OK. */
418 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
419 + if (INVALID_NDX (ndx, GElf_Sym)
420 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
421 {
422 __libelf_seterrno (ELF_E_INVALID_INDEX);
423 goto out;
424 --- elfutils-0.108/libelf/gelf_update_move.c.jj 2004-01-05 21:45:05.000000000 +0100
425 +++ elfutils-0.108/libelf/gelf_update_move.c 2005-05-14 01:31:25.000000000 +0200
426 @@ -1,5 +1,5 @@
427 /* Update move structure at the given index.
428 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
429 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
430 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
431
432 This program is free software; you can redistribute it and/or modify
433 @@ -42,7 +42,7 @@ gelf_update_move (data, ndx, src)
434 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
435
436 /* Check whether we have to resize the data buffer. */
437 - if (unlikely (ndx < 0)
438 + if (INVALID_NDX (ndx, GElf_Move)
439 || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
440 {
441 __libelf_seterrno (ELF_E_INVALID_INDEX);
442 --- elfutils-0.108/libelf/gelf_update_dyn.c.jj 2004-01-05 21:45:05.000000000 +0100
443 +++ elfutils-0.108/libelf/gelf_update_dyn.c 2005-05-14 01:31:25.000000000 +0200
444 @@ -1,5 +1,5 @@
445 /* Update information in dynamic table at the given index.
446 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
447 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
448 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
449
450 This program is free software; you can redistribute it and/or modify
451 @@ -38,12 +38,6 @@ gelf_update_dyn (data, ndx, src)
452 if (data == NULL)
453 return 0;
454
455 - if (unlikely (ndx < 0))
456 - {
457 - __libelf_seterrno (ELF_E_INVALID_INDEX);
458 - return 0;
459 - }
460 -
461 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
462 {
463 /* The type of the data better should match. */
464 @@ -69,7 +63,8 @@ gelf_update_dyn (data, ndx, src)
465 }
466
467 /* Check whether we have to resize the data buffer. */
468 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
469 + if (INVALID_NDX (ndx, Elf32_Dyn)
470 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
471 {
472 __libelf_seterrno (ELF_E_INVALID_INDEX);
473 goto out;
474 @@ -83,7 +78,8 @@ gelf_update_dyn (data, ndx, src)
475 else
476 {
477 /* Check whether we have to resize the data buffer. */
478 - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
479 + if (INVALID_NDX (ndx, Elf64_Dyn)
480 + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
481 {
482 __libelf_seterrno (ELF_E_INVALID_INDEX);
483 goto out;
484 --- elfutils-0.108/libelf/gelf_getversym.c.jj 2004-01-05 21:45:05.000000000 +0100
485 +++ elfutils-0.108/libelf/gelf_getversym.c 2005-05-14 01:31:25.000000000 +0200
486 @@ -1,5 +1,5 @@
487 /* Get symbol version information at the given index.
488 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
489 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
490 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
491
492 This program is free software; you can redistribute it and/or modify
493 @@ -59,7 +59,8 @@ gelf_getversym (data, ndx, dst)
494
495 /* The data is already in the correct form. Just make sure the
496 index is OK. */
497 - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
498 + if (INVALID_NDX (ndx, GElf_Versym)
499 + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
500 {
501 __libelf_seterrno (ELF_E_INVALID_INDEX);
502 result = NULL;
503 --- elfutils-0.108/libelf/elf32_newphdr.c.jj 2004-01-05 21:45:05.000000000 +0100
504 +++ elfutils-0.108/libelf/elf32_newphdr.c 2005-05-14 01:17:53.000000000 +0200
505 @@ -1,5 +1,5 @@
506 /* Create new ELF program header table.
507 - Copyright (C) 1999, 2000, 2002 Red Hat, Inc.
508 + Copyright (C) 1999, 2000, 2002, 2005 Red Hat, Inc.
509 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
510
511 This program is free software; you can redistribute it and/or modify
512 @@ -91,6 +91,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count)
513 else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
514 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
515 {
516 + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
517 + {
518 + result = NULL;
519 + goto out;
520 + }
521 +
522 /* Allocate a new program header with the appropriate number of
523 elements. */
524 result = (ElfW2(LIBELFBITS,Phdr) *)
525 --- elfutils-0.108/libelf/gelf_getdyn.c.jj 2004-01-05 21:45:05.000000000 +0100
526 +++ elfutils-0.108/libelf/gelf_getdyn.c 2005-05-14 01:31:25.000000000 +0200
527 @@ -1,5 +1,5 @@
528 /* Get information from dynamic table at the given index.
529 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
530 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
531 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
532
533 This program is free software; you can redistribute it and/or modify
534 @@ -60,7 +60,8 @@ gelf_getdyn (data, ndx, dst)
535 table entries has to be adopted. The user better has provided
536 a buffer where we can store the information. While copying the
537 data we are converting the format. */
538 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
539 + if (INVALID_NDX (ndx, Elf32_Dyn)
540 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
541 {
542 __libelf_seterrno (ELF_E_INVALID_INDEX);
543 goto out;
544 @@ -81,7 +82,8 @@ gelf_getdyn (data, ndx, dst)
545
546 /* The data is already in the correct form. Just make sure the
547 index is OK. */
548 - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
549 + if (INVALID_NDX (ndx, GElf_Dyn)
550 + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
551 {
552 __libelf_seterrno (ELF_E_INVALID_INDEX);
553 goto out;
554 --- elfutils-0.108/libelf/elf_getarsym.c.jj 2005-02-06 10:14:52.000000000 +0100
555 +++ elfutils-0.108/libelf/elf_getarsym.c 2005-05-14 01:37:47.000000000 +0200
556 @@ -144,6 +144,9 @@ elf_getarsym (elf, ptr)
557 size_t index_size = atol (tmpbuf);
558
559 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
560 +#if SIZE_MAX <= 4294967295U
561 + || n >= SIZE_MAX / sizeof (Elf_Arsym)
562 +#endif
563 || n * sizeof (uint32_t) > index_size)
564 {
565 /* This index table cannot be right since it does not fit into
566 --- elfutils-0.108/libelf/libelfP.h.jj 2005-03-30 03:42:32.000000000 +0200
567 +++ elfutils-0.108/libelf/libelfP.h 2005-05-14 01:28:47.000000000 +0200
568 @@ -531,4 +531,13 @@ extern uint32_t __libelf_crc32 (uint32_t
569 } while (0)
570 #endif
571
572 +/* Convenience macro. Assumes int NDX and TYPE with size at least
573 + 2 bytes. */
574 +#if SIZE_MAX > 4294967295U
575 +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
576 +#else
577 +# define INVALID_NDX(ndx, type) \
578 + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
579 +#endif
580 +
581 #endif /* libelfP.h */
582 --- elfutils-0.108/libelf/gelf_getlib.c.jj 2004-01-23 19:22:56.000000000 +0100
583 +++ elfutils-0.108/libelf/gelf_getlib.c 2005-05-14 01:31:25.000000000 +0200
584 @@ -1,5 +1,5 @@
585 /* Get library from table at the given index.
586 - Copyright (C) 2004 Red Hat, Inc.
587 + Copyright (C) 2004, 2005 Red Hat, Inc.
588 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
589
590 This program is free software; you can redistribute it and/or modify
591 @@ -53,7 +53,8 @@ gelf_getlib (data, ndx, dst)
592 /* The data is already in the correct form. Just make sure the
593 index is OK. */
594 GElf_Lib *result = NULL;
595 - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
596 + if (INVALID_NDX (ndx, GElf_Lib)
597 + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
598 __libelf_seterrno (ELF_E_INVALID_INDEX);
599 else
600 {
601 --- elfutils-0.108/libelf/gelf_update_symshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
602 +++ elfutils-0.108/libelf/gelf_update_symshndx.c 2005-05-14 01:31:25.000000000 +0200
603 @@ -1,6 +1,6 @@
604 /* Update symbol information and section index in symbol table at the
605 given index.
606 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
607 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
608 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
609
610 This program is free software; you can redistribute it and/or modify
611 @@ -44,12 +44,6 @@ gelf_update_symshndx (symdata, shndxdata
612 if (symdata == NULL)
613 return 0;
614
615 - if (unlikely (ndx < 0))
616 - {
617 - __libelf_seterrno (ELF_E_INVALID_INDEX);
618 - return 0;
619 - }
620 -
621 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
622 {
623 /* The type of the data better should match. */
624 @@ -95,7 +89,8 @@ gelf_update_symshndx (symdata, shndxdata
625 }
626
627 /* Check whether we have to resize the data buffer. */
628 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
629 + if (INVALID_NDX (ndx, Elf32_Sym)
630 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
631 {
632 __libelf_seterrno (ELF_E_INVALID_INDEX);
633 goto out;
634 @@ -118,7 +113,8 @@ gelf_update_symshndx (symdata, shndxdata
635 else
636 {
637 /* Check whether we have to resize the data buffer. */
638 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
639 + if (INVALID_NDX (ndx, Elf64_Sym)
640 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
641 {
642 __libelf_seterrno (ELF_E_INVALID_INDEX);
643 goto out;
644 --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-02-06 10:14:52.000000000 +0100
645 +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-14 00:32:57.000000000 +0200
646 @@ -66,7 +66,8 @@ elfw2(LIBELFBITS,getshdr) (scn)
647 goto out;
648
649 size_t shnum;
650 - if (INTUSE (elf_getshnum) (elf, &shnum) != 0)
651 + if (INTUSE (elf_getshnum) (elf, &shnum) != 0
652 + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
653 goto out;
654 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
655
656 --- elfutils-0.108/libelf/gelf_update_rela.c.jj 2004-01-05 21:45:05.000000000 +0100
657 +++ elfutils-0.108/libelf/gelf_update_rela.c 2005-05-14 01:31:25.000000000 +0200
658 @@ -1,5 +1,5 @@
659 /* Update RELA relocation information at given index.
660 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
661 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
662 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
663
664 This program is free software; you can redistribute it and/or modify
665 @@ -35,12 +35,6 @@ gelf_update_rela (Elf_Data *dst, int ndx
666 if (dst == NULL)
667 return 0;
668
669 - if (unlikely (ndx < 0))
670 - {
671 - __libelf_seterrno (ELF_E_INVALID_INDEX);
672 - return 0;
673 - }
674 -
675 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
676 {
677 /* The type of the data better should match. */
678 @@ -68,7 +62,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
679 }
680
681 /* Check whether we have to resize the data buffer. */
682 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
683 + if (INVALID_NDX (ndx, Elf32_Rela)
684 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
685 {
686 __libelf_seterrno (ELF_E_INVALID_INDEX);
687 goto out;
688 @@ -84,7 +79,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
689 else
690 {
691 /* Check whether we have to resize the data buffer. */
692 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
693 + if (INVALID_NDX (ndx, Elf64_Rela)
694 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
695 {
696 __libelf_seterrno (ELF_E_INVALID_INDEX);
697 goto out;
698 --- elfutils-0.108/libelf/gelf_update_versym.c.jj 2004-01-05 21:45:05.000000000 +0100
699 +++ elfutils-0.108/libelf/gelf_update_versym.c 2005-05-14 01:31:25.000000000 +0200
700 @@ -1,5 +1,5 @@
701 /* Update symbol version information.
702 - Copyright (C) 2001, 2002 Red Hat, Inc.
703 + Copyright (C) 2001, 2002, 2005 Red Hat, Inc.
704 Written by Ulrich Drepper <drepper@redhat.com>, 2001.
705
706 This program is free software; you can redistribute it and/or modify
707 @@ -42,7 +42,7 @@ gelf_update_versym (data, ndx, src)
708 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
709
710 /* Check whether we have to resize the data buffer. */
711 - if (unlikely (ndx < 0)
712 + if (INVALID_NDX (ndx, GElf_Versym)
713 || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
714 {
715 __libelf_seterrno (ELF_E_INVALID_INDEX);
716 --- elfutils-0.108/libelf/gelf_update_rel.c.jj 2004-01-05 21:45:05.000000000 +0100
717 +++ elfutils-0.108/libelf/gelf_update_rel.c 2005-05-14 01:31:25.000000000 +0200
718 @@ -1,5 +1,5 @@
719 /* Update REL relocation information at given index.
720 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
721 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
722 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
723
724 This program is free software; you can redistribute it and/or modify
725 @@ -35,12 +35,6 @@ gelf_update_rel (Elf_Data *dst, int ndx,
726 if (dst == NULL)
727 return 0;
728
729 - if (unlikely (ndx < 0))
730 - {
731 - __libelf_seterrno (ELF_E_INVALID_INDEX);
732 - return 0;
733 - }
734 -
735 if (unlikely (data_scn->d.d_type != ELF_T_REL))
736 {
737 /* The type of the data better should match. */
738 @@ -66,7 +60,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
739 }
740
741 /* Check whether we have to resize the data buffer. */
742 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
743 + if (INVALID_NDX (ndx, Elf32_Rel)
744 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
745 {
746 __libelf_seterrno (ELF_E_INVALID_INDEX);
747 goto out;
748 @@ -81,7 +76,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
749 else
750 {
751 /* Check whether we have to resize the data buffer. */
752 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
753 + if (INVALID_NDX (ndx, Elf64_Rel)
754 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
755 {
756 __libelf_seterrno (ELF_E_INVALID_INDEX);
757 goto out;
758 --- elfutils-0.108/src/elflint.c.jj 2005-05-07 01:46:26.000000000 +0200
759 +++ elfutils-0.108/src/elflint.c 2005-05-14 02:22:24.000000000 +0200
760 @@ -111,6 +111,9 @@ static uint32_t shstrndx;
761 /* Array to count references in section groups. */
762 static int *scnref;
763
764 +/* Number of sections. */
765 +static unsigned int shnum;
766 +
767
768 int
769 main (int argc, char *argv[])
770 @@ -300,10 +303,17 @@ section_name (Ebl *ebl, int idx)
771 {
772 GElf_Shdr shdr_mem;
773 GElf_Shdr *shdr;
774 + const char *ret;
775 +
776 + if ((unsigned int) idx > shnum)
777 + return "<invalid>";
778
779 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
780
781 - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
782 + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
783 + if (ret == NULL)
784 + return "<invalid>";
785 + return ret;
786 }
787
788
789 @@ -325,10 +335,6 @@ static const int valid_e_machine[] =
790 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
791
792
793 -/* Number of sections. */
794 -static unsigned int shnum;
795 -
796 -
797 static void
798 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
799 {
800 @@ -608,7 +614,8 @@ check_symtab (Ebl *ebl, GElf_Ehdr *ehdr,
801 xndxdata = NULL;
802 }
803
804 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
805 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
806 + if (shdr->sh_entsize != sh_entsize)
807 ERROR (gettext ("\
808 section [%2zu] '%s': entry size is does not match ElfXX_Sym\n"),
809 cnt, section_name (ebl, cnt));
810 @@ -646,7 +653,7 @@ section [%2d] '%s': XINDEX for zeroth en
811 xndxscnidx, section_name (ebl, xndxscnidx));
812 }
813
814 - for (cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
815 + for (cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
816 {
817 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
818 if (sym == NULL)
819 @@ -664,7 +671,8 @@ section [%2d] '%s': symbol %zu: invalid
820 else
821 {
822 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
823 - assert (name != NULL);
824 + assert (name != NULL
825 + || strshdr->sh_type != SHT_STRTAB);
826 }
827
828 if (sym->st_shndx == SHN_XINDEX)
829 @@ -954,7 +962,7 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
830 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
831 assert (rcshdr != NULL);
832
833 - if (rcshdr->sh_type == SHT_DYNAMIC)
834 + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
835 {
836 /* Found the dynamic section. Look through it. */
837 Elf_Data *d = elf_getdata (scn, NULL);
838 @@ -964,14 +972,17 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
839 {
840 GElf_Dyn dyn_mem;
841 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
842 - assert (dyn != NULL);
843 +
844 + if (dyn == NULL)
845 + break;
846
847 if (dyn->d_tag == DT_RELCOUNT)
848 {
849 /* Found it. One last check: does the number
850 specified number of relative relocations exceed
851 the total number of relocations? */
852 - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
853 + if (shdr->sh_entsize
854 + && dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
855 ERROR (gettext ("\
856 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
857 idx, section_name (ebl, idx),
858 @@ -1048,7 +1059,8 @@ section [%2d] '%s': no relocations for m
859 }
860 }
861
862 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT))
863 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
864 + if (shdr->sh_entsize != sh_entsize)
865 ERROR (gettext ("\
866 section [%2d] '%s': section entry size does not match ElfXX_Rela\n"),
867 idx, section_name (ebl, idx));
868 @@ -1058,7 +1070,7 @@ section [%2d] '%s': section entry size d
869 GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
870 Elf_Data *symdata = elf_getdata (symscn, NULL);
871
872 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
873 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
874 {
875 GElf_Rela rela_mem;
876 GElf_Rela *rela;
877 @@ -1183,7 +1195,8 @@ section [%2d] '%s': no relocations for m
878 }
879 }
880
881 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT))
882 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
883 + if (shdr->sh_entsize != sh_entsize)
884 ERROR (gettext ("\
885 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
886 idx, section_name (ebl, idx));
887 @@ -1193,7 +1206,7 @@ section [%2d] '%s': section entry size d
888 GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
889 Elf_Data *symdata = elf_getdata (symscn, NULL);
890
891 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
892 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
893 {
894 GElf_Rel rel_mem;
895 GElf_Rel *rel;
896 @@ -1341,7 +1354,8 @@ section [%2d] '%s': referenced as string
897 shdr->sh_link, section_name (ebl, shdr->sh_link),
898 idx, section_name (ebl, idx));
899
900 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
901 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
902 + if (shdr->sh_entsize != sh_entsize)
903 ERROR (gettext ("\
904 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
905 idx, section_name (ebl, idx));
906 @@ -1351,7 +1365,7 @@ section [%2d] '%s': section entry size d
907 idx, section_name (ebl, idx));
908
909 bool non_null_warned = false;
910 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
911 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
912 {
913 GElf_Dyn dyn_mem;
914 GElf_Dyn *dyn;
915 @@ -1502,6 +1516,8 @@ section [%2d] '%s': entry size does not
916 idx, section_name (ebl, idx));
917
918 if (symshdr != NULL
919 + && shdr->sh_entsize
920 + && symshdr->sh_entsize
921 && (shdr->sh_size / shdr->sh_entsize
922 < symshdr->sh_size / symshdr->sh_entsize))
923 ERROR (gettext ("\
924 @@ -1530,6 +1546,12 @@ section [%2d] '%s': extended section ind
925 }
926
927 data = elf_getdata (scn, NULL);
928 + if (data == NULL)
929 + {
930 + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
931 + idx, section_name (ebl, idx));
932 + return;
933 + }
934
935 if (*((Elf32_Word *) data->d_buf) != 0)
936 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
937 @@ -1613,7 +1635,7 @@ section [%2d] '%s': hash table section i
938 idx, section_name (ebl, idx), (long int) shdr->sh_size,
939 (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
940
941 - if (symshdr != NULL)
942 + if (symshdr != NULL && symshdr->sh_entsize)
943 {
944 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
945 size_t cnt;
946 @@ -1910,8 +1932,10 @@ section [%2d] '%s' refers in sh_link to
947 return;
948 }
949
950 - if (shdr->sh_size / shdr->sh_entsize
951 - != symshdr->sh_size / symshdr->sh_entsize)
952 + if (shdr->sh_entsize
953 + && symshdr->sh_entsize
954 + && shdr->sh_size / shdr->sh_entsize
955 + != symshdr->sh_size / symshdr->sh_entsize)
956 ERROR (gettext ("\
957 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
958 idx, section_name (ebl, idx),
959
960 --- elfutils-0.108/libelf/elf32_getphdr.c.jj 2005-02-06 10:14:52.000000000 +0100
961 +++ elfutils-0.108/libelf/elf32_getphdr.c 2005-05-17 16:53:41.000000000 +0200
962 @@ -80,6 +80,16 @@ elfw2(LIBELFBITS,getphdr) (elf)
963
964 if (elf->map_address != NULL)
965 {
966 + /* First see whether the information in the ELF header is
967 + valid and it does not ask for too much. */
968 + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
969 + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
970 + {
971 + /* Something is wrong. */
972 + __libelf_seterrno (ELF_E_INVALID_PHDR);
973 + goto out;
974 + }
975 +
976 /* All the data is already mapped. Use it. */
977 if (ehdr->e_ident[EI_DATA] == MY_ELFDATA
978 && (ALLOW_UNALIGNED
979 --- elfutils-0.108/libelf/elf_getshstrndx.c.jj 2004-01-05 21:45:05.000000000 +0100
980 +++ elfutils-0.108/libelf/elf_getshstrndx.c 2005-05-17 15:42:32.000000000 +0200
981 @@ -1,5 +1,5 @@
982 /* Return section index of section header string table.
983 - Copyright (C) 2002 Red Hat, Inc.
984 + Copyright (C) 2002, 2005 Red Hat, Inc.
985 Written by Ulrich Drepper <drepper@redhat.com>, 2002.
986
987 This program is free software; you can redistribute it and/or modify
988 @@ -90,10 +90,25 @@ elf_getshstrndx (elf, dst)
989 if (elf->map_address != NULL
990 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
991 && (ALLOW_UNALIGNED
992 - || (((size_t) ((char *) elf->map_address + offset))
993 + || (((size_t) ((char *) elf->map_address
994 + + elf->start_offset + offset))
995 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
996 - /* We can directly access the memory. */
997 - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
998 + {
999 + /* First see whether the information in the ELF header is
1000 + valid and it does not ask for too much. */
1001 + if (unlikely (offset + sizeof (Elf32_Shdr)
1002 + > elf->maximum_size))
1003 + {
1004 + /* Something is wrong. */
1005 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
1006 + result = -1;
1007 + goto out;
1008 + }
1009 +
1010 + /* We can directly access the memory. */
1011 + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
1012 + + offset))->sh_link;
1013 + }
1014 else
1015 {
1016 /* We avoid reading in all the section headers. Just read
1017 @@ -129,10 +144,25 @@ elf_getshstrndx (elf, dst)
1018 if (elf->map_address != NULL
1019 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
1020 && (ALLOW_UNALIGNED
1021 - || (((size_t) ((char *) elf->map_address + offset))
1022 + || (((size_t) ((char *) elf->map_address
1023 + + elf->start_offset + offset))
1024 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
1025 - /* We can directly access the memory. */
1026 - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
1027 + {
1028 + /* First see whether the information in the ELF header is
1029 + valid and it does not ask for too much. */
1030 + if (unlikely (offset + sizeof (Elf64_Shdr)
1031 + > elf->maximum_size))
1032 + {
1033 + /* Something is wrong. */
1034 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
1035 + result = -1;
1036 + goto out;
1037 + }
1038 +
1039 + /* We can directly access the memory. */
1040 + num = ((Elf64_Shdr *) (elf->map_address
1041 + + elf->start_offset + offset))->sh_link;
1042 + }
1043 else
1044 {
1045 /* We avoid reading in all the section headers. Just read
1046 --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-05-14 00:32:57.000000000 +0200
1047 +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-17 15:27:52.000000000 +0200
1048 @@ -71,7 +71,7 @@ elfw2(LIBELFBITS,getshdr) (scn)
1049 goto out;
1050 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
1051
1052 - /* Allocate memory for the program headers. We know the number
1053 + /* Allocate memory for the section headers. We know the number
1054 of entries from the ELF header. */
1055 ElfW2(LIBELFBITS,Shdr) *shdr = elf->state.ELFW(elf,LIBELFBITS).shdr =
1056 (ElfW2(LIBELFBITS,Shdr) *) malloc (size);
1057 @@ -93,6 +93,16 @@ elfw2(LIBELFBITS,getshdr) (scn)
1058 && (ehdr->e_shoff
1059 & (__alignof__ (ElfW2(LIBELFBITS,Shdr)) - 1)) != 0));
1060
1061 + /* First see whether the information in the ELF header is
1062 + valid and it does not ask for too much. */
1063 + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
1064 + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
1065 + {
1066 + /* Something is wrong. */
1067 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
1068 + goto free_and_out;
1069 + }
1070 +
1071 /* Now copy the data and at the same time convert the byte
1072 order. */
1073 if (ALLOW_UNALIGNED
1074 --- elfutils-0.108/libelf/elf_begin.c.jj 2005-05-17 16:18:51.000000000 +0200
1075 +++ elfutils-0.108/libelf/elf_begin.c 2005-05-17 17:31:37.000000000 +0200
1076 @@ -77,7 +77,11 @@ get_shnum (void *map_address, unsigned c
1077 || (((size_t) ((char *) map_address + offset))
1078 & ((is32 ? __alignof__ (Elf32_Ehdr) : __alignof__ (Elf64_Ehdr))
1079 - 1)) == 0))
1080 - ehdr.p = (char *) map_address + offset;
1081 + {
1082 + ehdr.p = (char *) map_address + offset;
1083 + if (maxsize < (is32 ? sizeof (Elf32_Ehdr) : sizeof (Elf64_Ehdr)))
1084 + return (size_t) -1l;
1085 + }
1086 else
1087 {
1088 /* We have to read the data from the file. */
1089 @@ -111,7 +115,8 @@ get_shnum (void *map_address, unsigned c
1090
1091 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
1092 {
1093 - if (offset + ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
1094 + if (unlikely (ehdr.e32->e_shoff >= maxsize)
1095 + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
1096 /* Cannot read the first section header. */
1097 return (size_t) -1l;
1098
1099 @@ -147,7 +152,8 @@ get_shnum (void *map_address, unsigned c
1100
1101 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
1102 {
1103 - if (offset + ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
1104 + if (unlikely (ehdr.e64->e_shoff >= maxsize)
1105 + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
1106 /* Cannot read the first section header. */
1107 return (size_t) -1l;
1108
1109 @@ -224,6 +226,15 @@ file_read_elf (int fildes, void *map_add
1110 /* Could not determine the number of sections. */
1111 return NULL;
1112
1113 + /* Check for too many sections. */
1114 + if (e_ident[EI_CLASS] == ELFCLASS32)
1115 + {
1116 + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
1117 + return NULL;
1118 + }
1119 + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
1120 + return NULL;
1121 +
1122 /* We can now allocate the memory. */
1123 elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
1124 ELF_K_ELF, scncnt * sizeof (Elf_Scn));
1125 @@ -255,15 +270,31 @@ file_read_elf (int fildes, void *map_add
1126 /* We can use the mmapped memory. */
1127 elf->state.elf32.ehdr =
1128 (Elf32_Ehdr *) ((char *) map_address + offset);
1129 + if (unlikely (elf->state.elf32.ehdr->e_shoff >= maxsize)
1130 + || unlikely (elf->state.elf32.ehdr->e_shoff
1131 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
1132 + {
1133 + free_and_out:
1134 + __libelf_seterrno (ELF_E_INVALID_FILE);
1135 + free (elf);
1136 + return NULL;
1137 + }
1138 elf->state.elf32.shdr =
1139 (Elf32_Shdr *) ((char *) map_address + offset
1140 + elf->state.elf32.ehdr->e_shoff);
1141 if (elf->state.elf32.ehdr->e_phnum)
1142 - /* Assign a value only if there really is a program
1143 - header. Otherwise the value remains NULL. */
1144 - elf->state.elf32.phdr
1145 - = (Elf32_Phdr *) ((char *) map_address + offset
1146 - + elf->state.elf32.ehdr->e_phoff);
1147 + {
1148 + /* Assign a value only if there really is a program
1149 + header. Otherwise the value remains NULL. */
1150 + if (unlikely (elf->state.elf32.ehdr->e_phoff >= maxsize)
1151 + || unlikely (elf->state.elf32.ehdr->e_phoff
1152 + + elf->state.elf32.ehdr->e_phnum
1153 + * sizeof (Elf32_Phdr) > maxsize))
1154 + goto free_and_out;
1155 + elf->state.elf32.phdr
1156 + = (Elf32_Phdr *) ((char *) map_address + offset
1157 + + elf->state.elf32.ehdr->e_phoff);
1158 + }
1159
1160 for (size_t cnt = 0; cnt < scncnt; ++cnt)
1161 {
1162 @@ -285,8 +316,7 @@ file_read_elf (int fildes, void *map_add
1163 sizeof (Elf32_Ehdr), offset) != sizeof (Elf32_Ehdr))
1164 {
1165 /* We must be able to read the ELF header. */
1166 - __libelf_seterrno (ELF_E_INVALID_FILE);
1167 - return NULL;
1168 + goto free_and_out;
1169 }
1170
1171 if (e_ident[EI_DATA] != MY_ELFDATA)
1172 @@ -340,15 +370,26 @@ file_read_elf (int fildes, void *map_add
1173 /* We can use the mmapped memory. */
1174 elf->state.elf64.ehdr =
1175 (Elf64_Ehdr *) ((char *) map_address + offset);
1176 + if (unlikely (elf->state.elf64.ehdr->e_shoff >= maxsize)
1177 + || unlikely (elf->state.elf64.ehdr->e_shoff
1178 + + scncnt * sizeof (Elf64_Shdr) > maxsize))
1179 + goto free_and_out;
1180 elf->state.elf64.shdr =
1181 (Elf64_Shdr *) ((char *) map_address + offset
1182 + elf->state.elf64.ehdr->e_shoff);
1183 if (elf->state.elf64.ehdr->e_phnum)
1184 - /* Assign a value only if there really is a program
1185 - header. Otherwise the value remains NULL. */
1186 - elf->state.elf64.phdr
1187 - = (Elf64_Phdr *) ((char *) map_address + offset
1188 - + elf->state.elf64.ehdr->e_phoff);
1189 + {
1190 + /* Assign a value only if there really is a program
1191 + header. Otherwise the value remains NULL. */
1192 + if (unlikely (elf->state.elf64.ehdr->e_phoff >= maxsize)
1193 + || unlikely (elf->state.elf64.ehdr->e_phoff
1194 + + elf->state.elf64.ehdr->e_phnum
1195 + * sizeof (Elf64_Phdr) > maxsize))
1196 + goto free_and_out;
1197 + elf->state.elf64.phdr
1198 + = (Elf64_Phdr *) ((char *) map_address + offset
1199 + + elf->state.elf64.ehdr->e_phoff);
1200 + }
1201
1202 for (size_t cnt = 0; cnt < scncnt; ++cnt)
1203 {
1204 @@ -370,8 +411,7 @@ file_read_elf (int fildes, void *map_add
1205 sizeof (Elf64_Ehdr), offset) != sizeof (Elf64_Ehdr))
1206 {
1207 /* We must be able to read the ELF header. */
1208 - __libelf_seterrno (ELF_E_INVALID_FILE);
1209 - return NULL;
1210 + goto free_and_out;
1211 }
1212
1213 if (e_ident[EI_DATA] != MY_ELFDATA)
1214 --- elfutils-0.108/src/elflint.c.jj 2005-05-14 02:22:24.000000000 +0200
1215 +++ elfutils-0.108/src/elflint.c 2005-05-17 18:02:00.000000000 +0200
1216 @@ -309,6 +309,8 @@ section_name (Ebl *ebl, int idx)
1217 return "<invalid>";
1218
1219 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
1220 + if (shdr == NULL)
1221 + return "<invalid>";
1222
1223 ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
1224 if (ret == NULL)
1225 @@ -1639,19 +1641,26 @@ section [%2d] '%s': hash table section i
1226 {
1227 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
1228 size_t cnt;
1229 + Elf32_Word *buf, *end;
1230
1231 if (nchain < symshdr->sh_size / symshdr->sh_entsize)
1232 ERROR (gettext ("section [%2d] '%s': chain array not large enough\n"),
1233 idx, section_name (ebl, idx));
1234
1235 + buf = ((Elf32_Word *) data->d_buf) + 2;
1236 + end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
1237 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1238 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
1239 + if (buf >= end)
1240 + return;
1241 + else if (*buf++ >= symsize)
1242 ERROR (gettext ("\
1243 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1244 idx, section_name (ebl, idx), cnt - 2);
1245
1246 for (; cnt < 2 + nbucket + nchain; ++cnt)
1247 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
1248 + if (buf >= end)
1249 + return;
1250 + else if (*buf++ >= symsize)
1251 ERROR (gettext ("\
1252 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
1253 idx, section_name (ebl, idx), cnt - 2 - nbucket);
1254 @@ -2311,6 +2320,8 @@ phdr[%d]: no note entries defined for th
1255 return;
1256
1257 char *notemem = gelf_rawchunk (ebl->elf, phdr->p_offset, phdr->p_filesz);
1258 + if (notemem == NULL)
1259 + return;
1260
1261 /* ELF64 files often use note section entries in the 32-bit format.
1262 The p_align field is set to 8 in case the 64-bit format is used.
1263
1264 --- elfutils/src/strip.c
1265 +++ elfutils/src/strip.c
1266 @@ -400,6 +400,7 @@ handle_elf (int fd, Elf *elf, const char
1267 Elf_Data debuglink_crc_data;
1268 bool any_symtab_changes = false;
1269 Elf_Data *shstrtab_data = NULL;
1270 + size_t shdridx = 0;
1271
1272 /* Create the full name of the file. */
1273 if (prefix != NULL)
1274 @@ -531,6 +532,11 @@ handle_elf (int fd, Elf *elf, const char
1275 goto fail_close;
1276 }
1277
1278 + if (shstrndx >= shnum)
1279 + goto illformed;
1280 +
1281 +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
1282 +
1283 /* Storage for section information. We leave room for two more
1284 entries since we unconditionally create a section header string
1285 table. Maybe some weird tool created an ELF file without one.
1286 @@ -552,7 +558,7 @@ handle_elf (int fd, Elf *elf, const char
1287 {
1288 /* This should always be true (i.e., there should not be any
1289 holes in the numbering). */
1290 - assert (elf_ndxscn (scn) == cnt);
1291 + elf_assert (elf_ndxscn (scn) == cnt);
1292
1293 shdr_info[cnt].scn = scn;
1294
1295 @@ -565,6 +571,7 @@ handle_elf (int fd, Elf *elf, const char
1296 shdr_info[cnt].shdr.sh_name);
1297 if (shdr_info[cnt].name == NULL)
1298 {
1299 + illformed:
1300 error (0, 0, gettext ("illformed file '%s'"), fname);
1301 goto fail_close;
1302 }
1303 @@ -574,6 +581,8 @@ handle_elf (int fd, Elf *elf, const char
1304
1305 /* Remember the shdr.sh_link value. */
1306 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
1307 + if (shdr_info[cnt].old_sh_link >= shnum)
1308 + goto illformed;
1309
1310 /* Sections in files other than relocatable object files which
1311 are not loaded can be freely moved by us. In relocatable
1312 @@ -586,7 +595,7 @@ handle_elf (int fd, Elf *elf, const char
1313 appropriate reference. */
1314 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
1315 {
1316 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1317 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1318 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
1319 }
1320 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
1321 @@ -605,7 +614,12 @@ handle_elf (int fd, Elf *elf, const char
1322 for (inner = 1;
1323 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
1324 ++inner)
1325 - shdr_info[grpref[inner]].group_idx = cnt;
1326 + {
1327 + if (grpref[inner] < shnum)
1328 + shdr_info[grpref[inner]].group_idx = cnt;
1329 + else
1330 + goto illformed;
1331 + }
1332
1333 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
1334 /* If the section group contains only one element and this
1335 @@ -616,7 +630,7 @@ handle_elf (int fd, Elf *elf, const char
1336 }
1337 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
1338 {
1339 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1340 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1341 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
1342 }
1343
1344 @@ -624,7 +638,7 @@ handle_elf (int fd, Elf *elf, const char
1345 discarded right away. */
1346 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
1347 {
1348 - assert (shdr_info[cnt].group_idx != 0);
1349 + elf_assert (shdr_info[cnt].group_idx != 0);
1350
1351 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
1352 {
1353 @@ -700,10 +714,14 @@ handle_elf (int fd, Elf *elf, const char
1354 {
1355 /* If a relocation section is marked as being removed make
1356 sure the section it is relocating is removed, too. */
1357 - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
1358 - || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1359 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1360 - shdr_info[cnt].idx = 1;
1361 + if (shdr_info[cnt].shdr.sh_type == SHT_REL
1362 + || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1363 + {
1364 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1365 + goto illformed;
1366 + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1367 + shdr_info[cnt].idx = 1;
1368 + }
1369 }
1370
1371 if (shdr_info[cnt].idx == 1)
1372 @@ -733,7 +751,7 @@ handle_elf (int fd, Elf *elf, const char
1373 if (shdr_info[cnt].symtab_idx != 0
1374 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
1375 {
1376 - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1377 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1378
1379 shdr_info[shdr_info[cnt].symtab_idx].data
1380 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1381 @@ -773,6 +791,9 @@ handle_elf (int fd, Elf *elf, const char
1382 else if (scnidx == SHN_XINDEX)
1383 scnidx = xndx;
1384
1385 + if (scnidx >= shnum)
1386 + goto illformed;
1387 +
1388 if (shdr_info[scnidx].idx == 0)
1389 {
1390 /* Mark this section as used. */
1391 @@ -804,11 +825,15 @@ handle_elf (int fd, Elf *elf, const char
1392 }
1393
1394 /* Handle references through sh_info. */
1395 - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
1396 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1397 + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
1398 {
1399 - shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1400 - changes |= shdr_info[cnt].shdr.sh_info < cnt;
1401 + if (shdr_info[cnt].shdr.sh_info >= shnum)
1402 + goto illformed;
1403 + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1404 + {
1405 + shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1406 + changes |= shdr_info[cnt].shdr.sh_info < cnt;
1407 + }
1408 }
1409
1410 /* Mark the section as investigated. */
1411 @@ -911,7 +936,7 @@ handle_elf (int fd, Elf *elf, const char
1412 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
1413 elf_errmsg (-1));
1414
1415 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1416 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1417
1418 /* Add this name to the section header string table. */
1419 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
1420 @@ -951,7 +976,7 @@ handle_elf (int fd, Elf *elf, const char
1421 error (EXIT_FAILURE, 0,
1422 gettext ("while create section header section: %s"),
1423 elf_errmsg (-1));
1424 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1425 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1426
1427 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
1428 if (shdr_info[cnt].data == NULL)
1429 @@ -982,7 +1007,7 @@ handle_elf (int fd, Elf *elf, const char
1430 }
1431
1432 /* Index of the section header table in the shdr_info array. */
1433 - size_t shdridx = cnt;
1434 + shdridx = cnt;
1435
1436 /* Add the section header string table section name. */
1437 shdr_info[cnt].se = ebl_strtabadd (shst, ".shstrtab", 10);
1438 @@ -1007,7 +1032,7 @@ handle_elf (int fd, Elf *elf, const char
1439 error (EXIT_FAILURE, 0,
1440 gettext ("while create section header section: %s"),
1441 elf_errmsg (-1));
1442 - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1443 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1444
1445 /* Finalize the string table and fill in the correct indices in the
1446 section headers. */
1447 @@ -1097,21 +1122,21 @@ handle_elf (int fd, Elf *elf, const char
1448 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1449 NULL);
1450
1451 - assert ((versiondata->d_size / sizeof (Elf32_Word))
1452 - >= shdr_info[cnt].data->d_size / elsize);
1453 + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
1454 + >= shdr_info[cnt].data->d_size / elsize);
1455 }
1456
1457 if (shdr_info[cnt].version_idx != 0)
1458 {
1459 - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1460 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1461 /* This section has associated version
1462 information. We have to modify that
1463 information, too. */
1464 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
1465 NULL);
1466
1467 - assert ((versiondata->d_size / sizeof (GElf_Versym))
1468 - >= shdr_info[cnt].data->d_size / elsize);
1469 + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
1470 + >= shdr_info[cnt].data->d_size / elsize);
1471 }
1472
1473 shdr_info[cnt].newsymidx
1474 @@ -1165,7 +1190,7 @@ handle_elf (int fd, Elf *elf, const char
1475 sec = shdr_info[sym->st_shndx].idx;
1476 else
1477 {
1478 - assert (shndxdata != NULL);
1479 + elf_assert (shndxdata != NULL);
1480
1481 sec = shdr_info[xshndx].idx;
1482 }
1483 @@ -1186,7 +1211,7 @@ handle_elf (int fd, Elf *elf, const char
1484 nxshndx = sec;
1485 }
1486
1487 - assert (sec < SHN_LORESERVE || shndxdata != NULL);
1488 + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
1489
1490 if ((inner != destidx || nshndx != sym->st_shndx
1491 || (shndxdata != NULL && nxshndx != xshndx))
1492 @@ -1209,7 +1234,7 @@ handle_elf (int fd, Elf *elf, const char
1493 else
1494 /* This is a section symbol for a section which has
1495 been removed. */
1496 - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1497 + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1498 }
1499
1500 if (destidx != inner)
1501 @@ -1373,11 +1398,11 @@ handle_elf (int fd, Elf *elf, const char
1502 {
1503 GElf_Sym sym_mem;
1504 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1505 - assert (sym != NULL);
1506 + elf_assert (sym != NULL);
1507
1508 const char *name = elf_strptr (elf, strshndx,
1509 sym->st_name);
1510 - assert (name != NULL);
1511 + elf_assert (name != NULL);
1512 size_t hidx = elf_hash (name) % nbucket;
1513
1514 if (bucket[hidx] == 0)
1515 @@ -1396,8 +1421,8 @@ handle_elf (int fd, Elf *elf, const char
1516 else
1517 {
1518 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
1519 - assert (shdr_info[cnt].shdr.sh_entsize
1520 - == sizeof (Elf64_Xword));
1521 + elf_assert (shdr_info[cnt].shdr.sh_entsize
1522 + == sizeof (Elf64_Xword));
1523
1524 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
1525
1526 @@ -1430,11 +1455,11 @@ handle_elf (int fd, Elf *elf, const char
1527 {
1528 GElf_Sym sym_mem;
1529 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1530 - assert (sym != NULL);
1531 + elf_assert (sym != NULL);
1532
1533 const char *name = elf_strptr (elf, strshndx,
1534 sym->st_name);
1535 - assert (name != NULL);
1536 + elf_assert (name != NULL);
1537 size_t hidx = elf_hash (name) % nbucket;
1538
1539 if (bucket[hidx] == 0)
1540 --- elfutils/src/readelf.c
1541 +++ elfutils/src/readelf.c
1542 @@ -947,6 +947,7 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
1543 GElf_Shdr *symshdr;
1544 Elf_Data *symdata;
1545 GElf_Sym sym_mem;
1546 + GElf_Sym *sym;
1547 size_t cnt;
1548 size_t shstrndx;
1549
1550 @@ -966,6 +967,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
1551 error (EXIT_FAILURE, 0,
1552 gettext ("cannot get section header string table index"));
1553
1554 + sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
1555 +
1556 grpref = (Elf32_Word *) data->d_buf;
1557
1558 printf ((grpref[0] & GRP_COMDAT)
1559 @@ -980,8 +983,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
1560 data->d_size / sizeof (Elf32_Word) - 1),
1561 elf_ndxscn (scn),
1562 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
1563 - elf_strptr (ebl->elf, symshdr->sh_link,
1564 - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
1565 + (sym == NULL ? NULL
1566 + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
1567 ?: gettext ("<INVALID SYMBOL>"),
1568 data->d_size / sizeof (Elf32_Word) - 1);
1569
1570 @@ -1135,7 +1138,8 @@ static void
1571 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
1572 {
1573 int class = gelf_getclass (ebl->elf);
1574 - GElf_Shdr glink;
1575 + GElf_Shdr glink_mem;
1576 + GElf_Shdr *glink;
1577 Elf_Data *data;
1578 size_t cnt;
1579 size_t shstrndx;
1580 @@ -1150,6 +1154,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
1581 error (EXIT_FAILURE, 0,
1582 gettext ("cannot get section header string table index"));
1583
1584 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1585 + if (glink == NULL)
1586 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1587 + elf_ndxscn (scn));
1588 +
1589 printf (ngettext ("\
1590 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1591 "\
1592 @@ -1159,9 +1168,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
1593 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1594 shdr->sh_offset,
1595 (int) shdr->sh_link,
1596 - elf_strptr (ebl->elf, shstrndx,
1597 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1598 - &glink)->sh_name));
1599 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1600 fputs_unlocked (gettext (" Type Value\n"), stdout);
1601
1602 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1603 @@ -1656,7 +1663,8 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
1604 unsigned int cnt;
1605 Elf32_Word verneed_stridx = 0;
1606 Elf32_Word verdef_stridx = 0;
1607 - GElf_Shdr glink;
1608 + GElf_Shdr glink_mem;
1609 + GElf_Shdr *glink;
1610 size_t shstrndx;
1611
1612 /* Get the data of the section. */
1613 @@ -1701,6 +1709,11 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
1614 error (EXIT_FAILURE, 0,
1615 gettext ("cannot get section header string table index"));
1616
1617 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1618 + if (glink == NULL)
1619 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1620 + elf_ndxscn (scn));
1621 +
1622 /* Now we can compute the number of entries in the section. */
1623 nsyms = data->d_size / (class == ELFCLASS32
1624 ? sizeof (Elf32_Sym) : sizeof (Elf64_Sym));
1625 @@ -1715,9 +1728,7 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
1626 shdr->sh_info),
1627 (unsigned long int) shdr->sh_info,
1628 (unsigned int) shdr->sh_link,
1629 - elf_strptr (ebl->elf, shstrndx,
1630 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1631 - &glink)->sh_name));
1632 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1633
1634 fputs_unlocked (class == ELFCLASS32
1635 ? gettext ("\
1636 @@ -1945,7 +1956,8 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
1637 {
1638 Elf_Data *data;
1639 int class = gelf_getclass (ebl->elf);
1640 - GElf_Shdr glink;
1641 + GElf_Shdr glink_mem;
1642 + GElf_Shdr *glink;
1643 int cnt;
1644 unsigned int offset;
1645 size_t shstrndx;
1646 @@ -1960,6 +1972,11 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
1647 error (EXIT_FAILURE, 0,
1648 gettext ("cannot get section header string table index"));
1649
1650 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1651 + if (glink == NULL)
1652 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1653 + elf_ndxscn (scn));
1654 +
1655 printf (ngettext ("\
1656 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1657 "\
1658 @@ -1970,9 +1987,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
1659 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1660 shdr->sh_offset,
1661 (unsigned int) shdr->sh_link,
1662 - elf_strptr (ebl->elf, shstrndx,
1663 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1664 - &glink)->sh_name));
1665 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1666
1667 offset = 0;
1668 for (cnt = shdr->sh_info; --cnt >= 0; )
1669 @@ -2022,7 +2037,8 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
1670 {
1671 Elf_Data *data;
1672 int class = gelf_getclass (ebl->elf);
1673 - GElf_Shdr glink;
1674 + GElf_Shdr glink_mem;
1675 + GElf_Shdr *glink;
1676 int cnt;
1677 unsigned int offset;
1678 size_t shstrndx;
1679 @@ -2037,6 +2053,11 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
1680 error (EXIT_FAILURE, 0,
1681 gettext ("cannot get section header string table index"));
1682
1683 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1684 + if (glink == NULL)
1685 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1686 + elf_ndxscn (scn));
1687 +
1688 printf (ngettext ("\
1689 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1690 "\
1691 @@ -2048,9 +2069,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
1692 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1693 shdr->sh_offset,
1694 (unsigned int) shdr->sh_link,
1695 - elf_strptr (ebl->elf, shstrndx,
1696 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1697 - &glink)->sh_name));
1698 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1699
1700 offset = 0;
1701 for (cnt = shdr->sh_info; --cnt >= 0; )
1702 @@ -2106,7 +2125,8 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
1703 Elf_Data *data;
1704 int class = gelf_getclass (ebl->elf);
1705 Elf_Scn *verscn;
1706 - GElf_Shdr glink;
1707 + GElf_Shdr glink_mem;
1708 + GElf_Shdr *glink;
1709 Elf_Scn *defscn;
1710 Elf_Scn *needscn;
1711 const char **vername;
1712 @@ -2125,6 +2145,11 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
1713 error (EXIT_FAILURE, 0,
1714 gettext ("cannot get section header string table index"));
1715
1716 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1717 + if (glink == NULL)
1718 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1719 + elf_ndxscn (scn));
1720 +
1721 /* We have to find the version definition section and extract the
1722 version names. */
1723 defscn = NULL;
1724 @@ -2347,9 +2372,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
1725 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1726 shdr->sh_offset,
1727 (unsigned int) shdr->sh_link,
1728 - elf_strptr (ebl->elf, shstrndx,
1729 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1730 - &glink)->sh_name));
1731 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1732
1733 /* Now we can finally look at the actual contents of this section. */
1734 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1735 @@ -2425,7 +2448,8 @@ handle_hash (Ebl *ebl)
1736 Elf32_Word maxlength = 0;
1737 Elf32_Word nsyms = 0;
1738 uint64_t nzero_counts = 0;
1739 - GElf_Shdr glink;
1740 + GElf_Shdr glink_mem;
1741 + GElf_Shdr *glink;
1742
1743 if (data == NULL)
1744 {
1745 @@ -2434,6 +2458,16 @@ handle_hash (Ebl *ebl)
1746 continue;
1747 }
1748
1749 +
1750 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1751 + &glink_mem);
1752 + if (glink == NULL)
1753 + {
1754 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1755 + elf_ndxscn (scn));
1756 + continue;
1757 + }
1758 +
1759 nbucket = ((Elf32_Word *) data->d_buf)[0];
1760 nchain = ((Elf32_Word *) data->d_buf)[1];
1761 bucket = &((Elf32_Word *) data->d_buf)[2];
1762 @@ -2451,10 +2485,7 @@ handle_hash (Ebl *ebl)
1763 shdr->sh_addr,
1764 shdr->sh_offset,
1765 (unsigned int) shdr->sh_link,
1766 - elf_strptr (ebl->elf, shstrndx,
1767 - gelf_getshdr (elf_getscn (ebl->elf,
1768 - shdr->sh_link),
1769 - &glink)->sh_name));
1770 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1771
1772 lengths = (uint32_t *) xcalloc (nbucket, sizeof (uint32_t));
1773