Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/elfutils/patches/elfutils-0.108-robustify3.patch

    Contents of /trunk/elfutils/patches/elfutils-0.108-robustify3.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 144 - (show annotations) (download)
    Tue May 8 20:06:05 2007 UTC (16 years, 11 months ago) by niro
    File size: 67237 byte(s) 
    -import
    1 src/
    2 2005-06-09 Roland McGrath <roland@redhat.com>
    3
    4 * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
    5 (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
    6 (handle_scngrp): Check for bogus sh_info.
    7
    8 * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
    9 st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
    10 Don't use assert on input values, instead bail with "illformed" error.
    11
    12 2005-05-17 Jakub Jelinek <jakub@redhat.com>
    13
    14 libelf/
    15 * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
    16 table fits into object's bounds.
    17 * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
    18 elf->map_address. Check if first section header fits into object's
    19 bounds.
    20 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Fix comment pasto.
    21 Check if section header table fits into object's bounds.
    22 * elf_begin.c (get_shnum): Fail if maxsize is smaller than ELF headers.
    23 Ensure first section header fits into object's bounds.
    24 (file_read_elf): Make sure scncnt is small enough to allocate both
    25 ElfXX_Shdr and Elf_Scn array. Make sure section and program header
    26 tables fit into object's bounds. Avoid memory leak on failure.
    27
    28 src/
    29 * elflint.c (check_hash): Don't check entries beyond end of section.
    30 (check_note): Don't crash if gelf_rawchunk fails.
    31 (section_name): Return <invalid> if gelf_getshdr returns NULL.
    32
    33 2005-05-14 Jakub Jelinek <jakub@redhat.com>
    34
    35 libelf/
    36 * libelfP.h (INVALID_NDX): Define.
    37 * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
    38 * gelf_getlib.c (gelf_getlib): Likewise.
    39 * gelf_getmove.c (gelf_getmove): Likewise.
    40 * gelf_getrel.c (gelf_getrel): Likewise.
    41 * gelf_getrela.c (gelf_getrela): Likewise.
    42 * gelf_getsym.c (gelf_getsym): Likewise.
    43 * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
    44 * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
    45 * gelf_getversym.c (gelf_getversym): Likewise.
    46 * gelf_update_dyn.c (gelf_update_dyn): Likewise.
    47 * gelf_update_lib.c (gelf_update_lib): Likewise.
    48 * gelf_update_move.c (gelf_update_move): Likewise.
    49 * gelf_update_rel.c (gelf_update_rel): Likewise.
    50 * gelf_update_rela.c (gelf_update_rela): Likewise.
    51 * gelf_update_sym.c (gelf_update_sym): Likewise.
    52 * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
    53 * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
    54 * gelf_update_versym.c (gelf_update_versym): Likewise.
    55 * elf_newscn.c (elf_newscn): Check for overflow.
    56 * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
    57 (__elfw2(LIBELFBITS,updatefile)): Likewise.
    58 * elf_begin.c (file_read_elf): Likewise.
    59 * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
    60 * elf_getarsym.c (elf_getarsym): Likewise.
    61 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
    62 src/
    63 * elflint.c (section_name): Return "<invalid>" instead of
    64 crashing on invalid section name.
    65 (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
    66 check_symtab_shndx, check_hash, check_versym): Robustify.
    67
    68 --- elfutils-0.108/libelf/gelf_getrel.c.jj 2004-01-05 21:45:05.000000000 +0100
    69 +++ elfutils-0.108/libelf/gelf_getrel.c 2005-05-14 01:31:25.000000000 +0200
    70 @@ -1,5 +1,5 @@
    71 /* Get REL relocation information at given index.
    72 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    73 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    74 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    75
    76 This program is free software; you can redistribute it and/or modify
    77 @@ -38,12 +38,6 @@ gelf_getrel (data, ndx, dst)
    78 if (data_scn == NULL)
    79 return NULL;
    80
    81 - if (unlikely (ndx < 0))
    82 - {
    83 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    84 - return NULL;
    85 - }
    86 -
    87 if (unlikely (data_scn->d.d_type != ELF_T_REL))
    88 {
    89 __libelf_seterrno (ELF_E_INVALID_HANDLE);
    90 @@ -60,7 +54,8 @@ gelf_getrel (data, ndx, dst)
    91 if (scn->elf->class == ELFCLASS32)
    92 {
    93 /* We have to convert the data. */
    94 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    95 + if (INVALID_NDX (ndx, Elf32_Rel)
    96 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    97 {
    98 __libelf_seterrno (ELF_E_INVALID_INDEX);
    99 result = NULL;
    100 @@ -80,7 +75,8 @@ gelf_getrel (data, ndx, dst)
    101 {
    102 /* Simply copy the data after we made sure we are actually getting
    103 correct data. */
    104 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    105 + if (INVALID_NDX (ndx, Elf64_Rel)
    106 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    107 {
    108 __libelf_seterrno (ELF_E_INVALID_INDEX);
    109 result = NULL;
    110 --- elfutils-0.108/libelf/gelf_getsym.c.jj 2004-01-05 21:45:05.000000000 +0100
    111 +++ elfutils-0.108/libelf/gelf_getsym.c 2005-05-14 01:31:25.000000000 +0200
    112 @@ -1,5 +1,5 @@
    113 /* Get symbol information from symbol table at the given index.
    114 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
    115 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    116 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
    117
    118 This program is free software; you can redistribute it and/or modify
    119 @@ -57,7 +57,8 @@ gelf_getsym (data, ndx, dst)
    120 table entries has to be adopted. The user better has provided
    121 a buffer where we can store the information. While copying the
    122 data we are converting the format. */
    123 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    124 + if (INVALID_NDX (ndx, Elf32_Sym)
    125 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    126 {
    127 __libelf_seterrno (ELF_E_INVALID_INDEX);
    128 goto out;
    129 @@ -86,7 +87,8 @@ gelf_getsym (data, ndx, dst)
    130
    131 /* The data is already in the correct form. Just make sure the
    132 index is OK. */
    133 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    134 + if (INVALID_NDX (ndx, GElf_Sym)
    135 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    136 {
    137 __libelf_seterrno (ELF_E_INVALID_INDEX);
    138 goto out;
    139 --- elfutils-0.108/libelf/gelf_update_sym.c.jj 2004-01-05 21:45:05.000000000 +0100
    140 +++ elfutils-0.108/libelf/gelf_update_sym.c 2005-05-14 01:31:25.000000000 +0200
    141 @@ -1,5 +1,5 @@
    142 /* Update symbol information in symbol table at the given index.
    143 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    144 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    145 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    146
    147 This program is free software; you can redistribute it and/or modify
    148 @@ -39,12 +39,6 @@ gelf_update_sym (data, ndx, src)
    149 if (data == NULL)
    150 return 0;
    151
    152 - if (unlikely (ndx < 0))
    153 - {
    154 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    155 - return 0;
    156 - }
    157 -
    158 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
    159 {
    160 /* The type of the data better should match. */
    161 @@ -69,7 +63,8 @@ gelf_update_sym (data, ndx, src)
    162 }
    163
    164 /* Check whether we have to resize the data buffer. */
    165 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    166 + if (INVALID_NDX (ndx, Elf32_Sym)
    167 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    168 {
    169 __libelf_seterrno (ELF_E_INVALID_INDEX);
    170 goto out;
    171 @@ -92,7 +87,8 @@ gelf_update_sym (data, ndx, src)
    172 else
    173 {
    174 /* Check whether we have to resize the data buffer. */
    175 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    176 + if (INVALID_NDX (ndx, Elf64_Sym)
    177 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    178 {
    179 __libelf_seterrno (ELF_E_INVALID_INDEX);
    180 goto out;
    181 --- elfutils-0.108/libelf/gelf_getrela.c.jj 2004-01-05 21:45:05.000000000 +0100
    182 +++ elfutils-0.108/libelf/gelf_getrela.c 2005-05-14 01:31:25.000000000 +0200
    183 @@ -1,5 +1,5 @@
    184 /* Get RELA relocation information at given index.
    185 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    186 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    187 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    188
    189 This program is free software; you can redistribute it and/or modify
    190 @@ -38,12 +38,6 @@ gelf_getrela (data, ndx, dst)
    191 if (data_scn == NULL)
    192 return NULL;
    193
    194 - if (unlikely (ndx < 0))
    195 - {
    196 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    197 - return NULL;
    198 - }
    199 -
    200 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    201 {
    202 __libelf_seterrno (ELF_E_INVALID_HANDLE);
    203 @@ -60,7 +54,8 @@ gelf_getrela (data, ndx, dst)
    204 if (scn->elf->class == ELFCLASS32)
    205 {
    206 /* We have to convert the data. */
    207 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    208 + if (INVALID_NDX (ndx, Elf32_Rela)
    209 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    210 {
    211 __libelf_seterrno (ELF_E_INVALID_INDEX);
    212 result = NULL;
    213 @@ -81,7 +76,8 @@ gelf_getrela (data, ndx, dst)
    214 {
    215 /* Simply copy the data after we made sure we are actually getting
    216 correct data. */
    217 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    218 + if (INVALID_NDX (ndx, Elf64_Rela)
    219 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    220 {
    221 __libelf_seterrno (ELF_E_INVALID_INDEX);
    222 result = NULL;
    223 --- elfutils-0.108/libelf/gelf_update_syminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
    224 +++ elfutils-0.108/libelf/gelf_update_syminfo.c 2005-05-14 01:31:25.000000000 +0200
    225 @@ -1,5 +1,5 @@
    226 /* Update additional symbol information in symbol table at the given index.
    227 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    228 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    229 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    230
    231 This program is free software; you can redistribute it and/or modify
    232 @@ -39,12 +39,6 @@ gelf_update_syminfo (data, ndx, src)
    233 if (data == NULL)
    234 return 0;
    235
    236 - if (unlikely (ndx < 0))
    237 - {
    238 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    239 - return 0;
    240 - }
    241 -
    242 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
    243 {
    244 /* The type of the data better should match. */
    245 @@ -60,7 +54,8 @@ gelf_update_syminfo (data, ndx, src)
    246 rwlock_wrlock (scn->elf->lock);
    247
    248 /* Check whether we have to resize the data buffer. */
    249 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    250 + if (INVALID_NDX (ndx, GElf_Syminfo)
    251 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    252 {
    253 __libelf_seterrno (ELF_E_INVALID_INDEX);
    254 goto out;
    255 --- elfutils-0.108/libelf/gelf_getsyminfo.c.jj 2004-01-05 21:45:05.000000000 +0100
    256 +++ elfutils-0.108/libelf/gelf_getsyminfo.c 2005-05-14 01:31:25.000000000 +0200
    257 @@ -1,5 +1,5 @@
    258 /* Get additional symbol information from symbol table at the given index.
    259 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    260 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    261 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    262
    263 This program is free software; you can redistribute it and/or modify
    264 @@ -51,7 +51,8 @@ gelf_getsyminfo (data, ndx, dst)
    265
    266 /* The data is already in the correct form. Just make sure the
    267 index is OK. */
    268 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    269 + if (INVALID_NDX (ndx, GElf_Syminfo)
    270 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    271 {
    272 __libelf_seterrno (ELF_E_INVALID_INDEX);
    273 goto out;
    274 --- elfutils-0.108/libelf/elf_newscn.c.jj 2004-01-05 21:45:05.000000000 +0100
    275 +++ elfutils-0.108/libelf/elf_newscn.c 2005-05-14 01:38:35.000000000 +0200
    276 @@ -1,5 +1,5 @@
    277 /* Append new section.
    278 - Copyright (C) 1998, 1999, 2000, 2001, 2002 Red Hat, Inc.
    279 + Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    280 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
    281
    282 This program is free software; you can redistribute it and/or modify
    283 @@ -71,13 +71,21 @@ elf_newscn (elf)
    284 else
    285 {
    286 /* We must allocate a new element. */
    287 - Elf_ScnList *newp;
    288 + Elf_ScnList *newp = NULL;
    289
    290 assert (elf->state.elf.scnincr > 0);
    291
    292 - newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
    293 - + ((elf->state.elf.scnincr *= 2)
    294 - * sizeof (Elf_Scn)), 1);
    295 + if (
    296 +#if SIZE_MAX <= 4294967295U
    297 + likely (elf->state.elf.scnincr
    298 + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
    299 +#else
    300 + 1
    301 +#endif
    302 + )
    303 + newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
    304 + + ((elf->state.elf.scnincr *= 2)
    305 + * sizeof (Elf_Scn)), 1);
    306 if (newp == NULL)
    307 {
    308 __libelf_seterrno (ELF_E_NOMEM);
    309 --- elfutils-0.108/libelf/gelf_update_lib.c.jj 2004-01-23 19:23:03.000000000 +0100
    310 +++ elfutils-0.108/libelf/gelf_update_lib.c 2005-05-14 01:31:25.000000000 +0200
    311 @@ -1,5 +1,5 @@
    312 /* Update library in table at the given index.
    313 - Copyright (C) 2004 Red Hat, Inc.
    314 + Copyright (C) 2004, 2005 Red Hat, Inc.
    315 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
    316
    317 This program is free software; you can redistribute it and/or modify
    318 @@ -35,12 +35,6 @@ gelf_update_lib (data, ndx, src)
    319 if (data == NULL)
    320 return 0;
    321
    322 - if (unlikely (ndx < 0))
    323 - {
    324 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    325 - return 0;
    326 - }
    327 -
    328 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
    329 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
    330 {
    331 @@ -54,7 +48,8 @@ gelf_update_lib (data, ndx, src)
    332
    333 /* Check whether we have to resize the data buffer. */
    334 int result = 0;
    335 - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    336 + if (INVALID_NDX (ndx, Elf64_Lib)
    337 + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    338 __libelf_seterrno (ELF_E_INVALID_INDEX);
    339 else
    340 {
    341 --- elfutils-0.108/libelf/gelf_getmove.c.jj 2004-01-05 21:45:05.000000000 +0100
    342 +++ elfutils-0.108/libelf/gelf_getmove.c 2005-05-14 01:31:25.000000000 +0200
    343 @@ -1,5 +1,5 @@
    344 /* Get move structure at the given index.
    345 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    346 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    347 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    348
    349 This program is free software; you can redistribute it and/or modify
    350 @@ -50,7 +50,8 @@ gelf_getmove (data, ndx, dst)
    351
    352 /* The data is already in the correct form. Just make sure the
    353 index is OK. */
    354 - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    355 + if (INVALID_NDX (ndx, GElf_Move)
    356 + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    357 {
    358 __libelf_seterrno (ELF_E_INVALID_INDEX);
    359 goto out;
    360 --- elfutils-0.108/libelf/elf32_updatefile.c.jj 2005-02-06 10:14:52.000000000 +0100
    361 +++ elfutils-0.108/libelf/elf32_updatefile.c 2005-05-14 00:45:03.000000000 +0200
    362 @@ -164,6 +164,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf
    363 /* Write all the sections. Well, only those which are modified. */
    364 if (shnum > 0)
    365 {
    366 + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
    367 + return 1;
    368 +
    369 ElfW2(LIBELFBITS,Shdr) *shdr_dest;
    370 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
    371 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
    372 @@ -468,6 +471,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf
    373 /* Write all the sections. Well, only those which are modified. */
    374 if (shnum > 0)
    375 {
    376 + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
    377 + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
    378 + return 1;
    379 +
    380 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
    381 #if EV_NUM != 2
    382 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
    383 --- elfutils-0.108/libelf/gelf_getsymshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    384 +++ elfutils-0.108/libelf/gelf_getsymshndx.c 2005-05-14 01:31:25.000000000 +0200
    385 @@ -1,6 +1,6 @@
    386 /* Get symbol information and separate section index from symbol table
    387 at the given index.
    388 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    389 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    390 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    391
    392 This program is free software; you can redistribute it and/or modify
    393 @@ -57,7 +57,9 @@ gelf_getsymshndx (symdata, shndxdata, nd
    394 section index table. */
    395 if (likely (shndxdata_scn != NULL))
    396 {
    397 - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
    398 + if (INVALID_NDX (ndx, Elf32_Word)
    399 + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
    400 + > shndxdata_scn->d.d_size))
    401 {
    402 __libelf_seterrno (ELF_E_INVALID_INDEX);
    403 goto out;
    404 @@ -77,7 +79,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    405 table entries has to be adopted. The user better has provided
    406 a buffer where we can store the information. While copying the
    407 data we are converting the format. */
    408 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    409 + if (INVALID_NDX (ndx, Elf32_Sym)
    410 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    411 {
    412 __libelf_seterrno (ELF_E_INVALID_INDEX);
    413 goto out;
    414 @@ -106,7 +109,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    415
    416 /* The data is already in the correct form. Just make sure the
    417 index is OK. */
    418 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    419 + if (INVALID_NDX (ndx, GElf_Sym)
    420 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    421 {
    422 __libelf_seterrno (ELF_E_INVALID_INDEX);
    423 goto out;
    424 --- elfutils-0.108/libelf/gelf_update_move.c.jj 2004-01-05 21:45:05.000000000 +0100
    425 +++ elfutils-0.108/libelf/gelf_update_move.c 2005-05-14 01:31:25.000000000 +0200
    426 @@ -1,5 +1,5 @@
    427 /* Update move structure at the given index.
    428 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    429 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    430 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    431
    432 This program is free software; you can redistribute it and/or modify
    433 @@ -42,7 +42,7 @@ gelf_update_move (data, ndx, src)
    434 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
    435
    436 /* Check whether we have to resize the data buffer. */
    437 - if (unlikely (ndx < 0)
    438 + if (INVALID_NDX (ndx, GElf_Move)
    439 || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
    440 {
    441 __libelf_seterrno (ELF_E_INVALID_INDEX);
    442 --- elfutils-0.108/libelf/gelf_update_dyn.c.jj 2004-01-05 21:45:05.000000000 +0100
    443 +++ elfutils-0.108/libelf/gelf_update_dyn.c 2005-05-14 01:31:25.000000000 +0200
    444 @@ -1,5 +1,5 @@
    445 /* Update information in dynamic table at the given index.
    446 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    447 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    448 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    449
    450 This program is free software; you can redistribute it and/or modify
    451 @@ -38,12 +38,6 @@ gelf_update_dyn (data, ndx, src)
    452 if (data == NULL)
    453 return 0;
    454
    455 - if (unlikely (ndx < 0))
    456 - {
    457 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    458 - return 0;
    459 - }
    460 -
    461 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
    462 {
    463 /* The type of the data better should match. */
    464 @@ -69,7 +63,8 @@ gelf_update_dyn (data, ndx, src)
    465 }
    466
    467 /* Check whether we have to resize the data buffer. */
    468 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    469 + if (INVALID_NDX (ndx, Elf32_Dyn)
    470 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    471 {
    472 __libelf_seterrno (ELF_E_INVALID_INDEX);
    473 goto out;
    474 @@ -83,7 +78,8 @@ gelf_update_dyn (data, ndx, src)
    475 else
    476 {
    477 /* Check whether we have to resize the data buffer. */
    478 - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    479 + if (INVALID_NDX (ndx, Elf64_Dyn)
    480 + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    481 {
    482 __libelf_seterrno (ELF_E_INVALID_INDEX);
    483 goto out;
    484 --- elfutils-0.108/libelf/gelf_getversym.c.jj 2004-01-05 21:45:05.000000000 +0100
    485 +++ elfutils-0.108/libelf/gelf_getversym.c 2005-05-14 01:31:25.000000000 +0200
    486 @@ -1,5 +1,5 @@
    487 /* Get symbol version information at the given index.
    488 - Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
    489 + Copyright (C) 1999, 2000, 2001, 2002, 2005 Red Hat, Inc.
    490 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
    491
    492 This program is free software; you can redistribute it and/or modify
    493 @@ -59,7 +59,8 @@ gelf_getversym (data, ndx, dst)
    494
    495 /* The data is already in the correct form. Just make sure the
    496 index is OK. */
    497 - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    498 + if (INVALID_NDX (ndx, GElf_Versym)
    499 + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    500 {
    501 __libelf_seterrno (ELF_E_INVALID_INDEX);
    502 result = NULL;
    503 --- elfutils-0.108/libelf/elf32_newphdr.c.jj 2004-01-05 21:45:05.000000000 +0100
    504 +++ elfutils-0.108/libelf/elf32_newphdr.c 2005-05-14 01:17:53.000000000 +0200
    505 @@ -1,5 +1,5 @@
    506 /* Create new ELF program header table.
    507 - Copyright (C) 1999, 2000, 2002 Red Hat, Inc.
    508 + Copyright (C) 1999, 2000, 2002, 2005 Red Hat, Inc.
    509 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
    510
    511 This program is free software; you can redistribute it and/or modify
    512 @@ -91,6 +91,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count)
    513 else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
    514 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
    515 {
    516 + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
    517 + {
    518 + result = NULL;
    519 + goto out;
    520 + }
    521 +
    522 /* Allocate a new program header with the appropriate number of
    523 elements. */
    524 result = (ElfW2(LIBELFBITS,Phdr) *)
    525 --- elfutils-0.108/libelf/gelf_getdyn.c.jj 2004-01-05 21:45:05.000000000 +0100
    526 +++ elfutils-0.108/libelf/gelf_getdyn.c 2005-05-14 01:31:25.000000000 +0200
    527 @@ -1,5 +1,5 @@
    528 /* Get information from dynamic table at the given index.
    529 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    530 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    531 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    532
    533 This program is free software; you can redistribute it and/or modify
    534 @@ -60,7 +60,8 @@ gelf_getdyn (data, ndx, dst)
    535 table entries has to be adopted. The user better has provided
    536 a buffer where we can store the information. While copying the
    537 data we are converting the format. */
    538 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    539 + if (INVALID_NDX (ndx, Elf32_Dyn)
    540 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    541 {
    542 __libelf_seterrno (ELF_E_INVALID_INDEX);
    543 goto out;
    544 @@ -81,7 +82,8 @@ gelf_getdyn (data, ndx, dst)
    545
    546 /* The data is already in the correct form. Just make sure the
    547 index is OK. */
    548 - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    549 + if (INVALID_NDX (ndx, GElf_Dyn)
    550 + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    551 {
    552 __libelf_seterrno (ELF_E_INVALID_INDEX);
    553 goto out;
    554 --- elfutils-0.108/libelf/elf_getarsym.c.jj 2005-02-06 10:14:52.000000000 +0100
    555 +++ elfutils-0.108/libelf/elf_getarsym.c 2005-05-14 01:37:47.000000000 +0200
    556 @@ -144,6 +144,9 @@ elf_getarsym (elf, ptr)
    557 size_t index_size = atol (tmpbuf);
    558
    559 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
    560 +#if SIZE_MAX <= 4294967295U
    561 + || n >= SIZE_MAX / sizeof (Elf_Arsym)
    562 +#endif
    563 || n * sizeof (uint32_t) > index_size)
    564 {
    565 /* This index table cannot be right since it does not fit into
    566 --- elfutils-0.108/libelf/libelfP.h.jj 2005-03-30 03:42:32.000000000 +0200
    567 +++ elfutils-0.108/libelf/libelfP.h 2005-05-14 01:28:47.000000000 +0200
    568 @@ -531,4 +531,13 @@ extern uint32_t __libelf_crc32 (uint32_t
    569 } while (0)
    570 #endif
    571
    572 +/* Convenience macro. Assumes int NDX and TYPE with size at least
    573 + 2 bytes. */
    574 +#if SIZE_MAX > 4294967295U
    575 +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
    576 +#else
    577 +# define INVALID_NDX(ndx, type) \
    578 + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
    579 +#endif
    580 +
    581 #endif /* libelfP.h */
    582 --- elfutils-0.108/libelf/gelf_getlib.c.jj 2004-01-23 19:22:56.000000000 +0100
    583 +++ elfutils-0.108/libelf/gelf_getlib.c 2005-05-14 01:31:25.000000000 +0200
    584 @@ -1,5 +1,5 @@
    585 /* Get library from table at the given index.
    586 - Copyright (C) 2004 Red Hat, Inc.
    587 + Copyright (C) 2004, 2005 Red Hat, Inc.
    588 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
    589
    590 This program is free software; you can redistribute it and/or modify
    591 @@ -53,7 +53,8 @@ gelf_getlib (data, ndx, dst)
    592 /* The data is already in the correct form. Just make sure the
    593 index is OK. */
    594 GElf_Lib *result = NULL;
    595 - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    596 + if (INVALID_NDX (ndx, GElf_Lib)
    597 + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    598 __libelf_seterrno (ELF_E_INVALID_INDEX);
    599 else
    600 {
    601 --- elfutils-0.108/libelf/gelf_update_symshndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    602 +++ elfutils-0.108/libelf/gelf_update_symshndx.c 2005-05-14 01:31:25.000000000 +0200
    603 @@ -1,6 +1,6 @@
    604 /* Update symbol information and section index in symbol table at the
    605 given index.
    606 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    607 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    608 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    609
    610 This program is free software; you can redistribute it and/or modify
    611 @@ -44,12 +44,6 @@ gelf_update_symshndx (symdata, shndxdata
    612 if (symdata == NULL)
    613 return 0;
    614
    615 - if (unlikely (ndx < 0))
    616 - {
    617 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    618 - return 0;
    619 - }
    620 -
    621 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
    622 {
    623 /* The type of the data better should match. */
    624 @@ -95,7 +89,8 @@ gelf_update_symshndx (symdata, shndxdata
    625 }
    626
    627 /* Check whether we have to resize the data buffer. */
    628 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    629 + if (INVALID_NDX (ndx, Elf32_Sym)
    630 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    631 {
    632 __libelf_seterrno (ELF_E_INVALID_INDEX);
    633 goto out;
    634 @@ -118,7 +113,8 @@ gelf_update_symshndx (symdata, shndxdata
    635 else
    636 {
    637 /* Check whether we have to resize the data buffer. */
    638 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    639 + if (INVALID_NDX (ndx, Elf64_Sym)
    640 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    641 {
    642 __libelf_seterrno (ELF_E_INVALID_INDEX);
    643 goto out;
    644 --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-02-06 10:14:52.000000000 +0100
    645 +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-14 00:32:57.000000000 +0200
    646 @@ -66,7 +66,8 @@ elfw2(LIBELFBITS,getshdr) (scn)
    647 goto out;
    648
    649 size_t shnum;
    650 - if (INTUSE (elf_getshnum) (elf, &shnum) != 0)
    651 + if (INTUSE (elf_getshnum) (elf, &shnum) != 0
    652 + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
    653 goto out;
    654 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
    655
    656 --- elfutils-0.108/libelf/gelf_update_rela.c.jj 2004-01-05 21:45:05.000000000 +0100
    657 +++ elfutils-0.108/libelf/gelf_update_rela.c 2005-05-14 01:31:25.000000000 +0200
    658 @@ -1,5 +1,5 @@
    659 /* Update RELA relocation information at given index.
    660 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    661 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    662 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    663
    664 This program is free software; you can redistribute it and/or modify
    665 @@ -35,12 +35,6 @@ gelf_update_rela (Elf_Data *dst, int ndx
    666 if (dst == NULL)
    667 return 0;
    668
    669 - if (unlikely (ndx < 0))
    670 - {
    671 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    672 - return 0;
    673 - }
    674 -
    675 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    676 {
    677 /* The type of the data better should match. */
    678 @@ -68,7 +62,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    679 }
    680
    681 /* Check whether we have to resize the data buffer. */
    682 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    683 + if (INVALID_NDX (ndx, Elf32_Rela)
    684 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    685 {
    686 __libelf_seterrno (ELF_E_INVALID_INDEX);
    687 goto out;
    688 @@ -84,7 +79,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    689 else
    690 {
    691 /* Check whether we have to resize the data buffer. */
    692 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    693 + if (INVALID_NDX (ndx, Elf64_Rela)
    694 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    695 {
    696 __libelf_seterrno (ELF_E_INVALID_INDEX);
    697 goto out;
    698 --- elfutils-0.108/libelf/gelf_update_versym.c.jj 2004-01-05 21:45:05.000000000 +0100
    699 +++ elfutils-0.108/libelf/gelf_update_versym.c 2005-05-14 01:31:25.000000000 +0200
    700 @@ -1,5 +1,5 @@
    701 /* Update symbol version information.
    702 - Copyright (C) 2001, 2002 Red Hat, Inc.
    703 + Copyright (C) 2001, 2002, 2005 Red Hat, Inc.
    704 Written by Ulrich Drepper <drepper@redhat.com>, 2001.
    705
    706 This program is free software; you can redistribute it and/or modify
    707 @@ -42,7 +42,7 @@ gelf_update_versym (data, ndx, src)
    708 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
    709
    710 /* Check whether we have to resize the data buffer. */
    711 - if (unlikely (ndx < 0)
    712 + if (INVALID_NDX (ndx, GElf_Versym)
    713 || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
    714 {
    715 __libelf_seterrno (ELF_E_INVALID_INDEX);
    716 --- elfutils-0.108/libelf/gelf_update_rel.c.jj 2004-01-05 21:45:05.000000000 +0100
    717 +++ elfutils-0.108/libelf/gelf_update_rel.c 2005-05-14 01:31:25.000000000 +0200
    718 @@ -1,5 +1,5 @@
    719 /* Update REL relocation information at given index.
    720 - Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
    721 + Copyright (C) 2000, 2001, 2002, 2005 Red Hat, Inc.
    722 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
    723
    724 This program is free software; you can redistribute it and/or modify
    725 @@ -35,12 +35,6 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    726 if (dst == NULL)
    727 return 0;
    728
    729 - if (unlikely (ndx < 0))
    730 - {
    731 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    732 - return 0;
    733 - }
    734 -
    735 if (unlikely (data_scn->d.d_type != ELF_T_REL))
    736 {
    737 /* The type of the data better should match. */
    738 @@ -66,7 +60,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    739 }
    740
    741 /* Check whether we have to resize the data buffer. */
    742 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    743 + if (INVALID_NDX (ndx, Elf32_Rel)
    744 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    745 {
    746 __libelf_seterrno (ELF_E_INVALID_INDEX);
    747 goto out;
    748 @@ -81,7 +76,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    749 else
    750 {
    751 /* Check whether we have to resize the data buffer. */
    752 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    753 + if (INVALID_NDX (ndx, Elf64_Rel)
    754 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    755 {
    756 __libelf_seterrno (ELF_E_INVALID_INDEX);
    757 goto out;
    758 --- elfutils-0.108/src/elflint.c.jj 2005-05-07 01:46:26.000000000 +0200
    759 +++ elfutils-0.108/src/elflint.c 2005-05-14 02:22:24.000000000 +0200
    760 @@ -111,6 +111,9 @@ static uint32_t shstrndx;
    761 /* Array to count references in section groups. */
    762 static int *scnref;
    763
    764 +/* Number of sections. */
    765 +static unsigned int shnum;
    766 +
    767
    768 int
    769 main (int argc, char *argv[])
    770 @@ -300,10 +303,17 @@ section_name (Ebl *ebl, int idx)
    771 {
    772 GElf_Shdr shdr_mem;
    773 GElf_Shdr *shdr;
    774 + const char *ret;
    775 +
    776 + if ((unsigned int) idx > shnum)
    777 + return "<invalid>";
    778
    779 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
    780
    781 - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    782 + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    783 + if (ret == NULL)
    784 + return "<invalid>";
    785 + return ret;
    786 }
    787
    788
    789 @@ -325,10 +335,6 @@ static const int valid_e_machine[] =
    790 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
    791
    792
    793 -/* Number of sections. */
    794 -static unsigned int shnum;
    795 -
    796 -
    797 static void
    798 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
    799 {
    800 @@ -608,7 +614,8 @@ check_symtab (Ebl *ebl, GElf_Ehdr *ehdr,
    801 xndxdata = NULL;
    802 }
    803
    804 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
    805 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
    806 + if (shdr->sh_entsize != sh_entsize)
    807 ERROR (gettext ("\
    808 section [%2zu] '%s': entry size is does not match ElfXX_Sym\n"),
    809 cnt, section_name (ebl, cnt));
    810 @@ -646,7 +653,7 @@ section [%2d] '%s': XINDEX for zeroth en
    811 xndxscnidx, section_name (ebl, xndxscnidx));
    812 }
    813
    814 - for (cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    815 + for (cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
    816 {
    817 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
    818 if (sym == NULL)
    819 @@ -664,7 +671,8 @@ section [%2d] '%s': symbol %zu: invalid
    820 else
    821 {
    822 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
    823 - assert (name != NULL);
    824 + assert (name != NULL
    825 + || strshdr->sh_type != SHT_STRTAB);
    826 }
    827
    828 if (sym->st_shndx == SHN_XINDEX)
    829 @@ -954,7 +962,7 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
    830 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
    831 assert (rcshdr != NULL);
    832
    833 - if (rcshdr->sh_type == SHT_DYNAMIC)
    834 + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
    835 {
    836 /* Found the dynamic section. Look through it. */
    837 Elf_Data *d = elf_getdata (scn, NULL);
    838 @@ -964,14 +972,17 @@ is_rel_dyn (Ebl *ebl, GElf_Ehdr *ehdr, i
    839 {
    840 GElf_Dyn dyn_mem;
    841 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
    842 - assert (dyn != NULL);
    843 +
    844 + if (dyn == NULL)
    845 + break;
    846
    847 if (dyn->d_tag == DT_RELCOUNT)
    848 {
    849 /* Found it. One last check: does the number
    850 specified number of relative relocations exceed
    851 the total number of relocations? */
    852 - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
    853 + if (shdr->sh_entsize
    854 + && dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
    855 ERROR (gettext ("\
    856 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
    857 idx, section_name (ebl, idx),
    858 @@ -1048,7 +1059,8 @@ section [%2d] '%s': no relocations for m
    859 }
    860 }
    861
    862 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT))
    863 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
    864 + if (shdr->sh_entsize != sh_entsize)
    865 ERROR (gettext ("\
    866 section [%2d] '%s': section entry size does not match ElfXX_Rela\n"),
    867 idx, section_name (ebl, idx));
    868 @@ -1058,7 +1070,7 @@ section [%2d] '%s': section entry size d
    869 GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
    870 Elf_Data *symdata = elf_getdata (symscn, NULL);
    871
    872 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    873 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    874 {
    875 GElf_Rela rela_mem;
    876 GElf_Rela *rela;
    877 @@ -1183,7 +1195,8 @@ section [%2d] '%s': no relocations for m
    878 }
    879 }
    880
    881 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT))
    882 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
    883 + if (shdr->sh_entsize != sh_entsize)
    884 ERROR (gettext ("\
    885 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
    886 idx, section_name (ebl, idx));
    887 @@ -1193,7 +1206,7 @@ section [%2d] '%s': section entry size d
    888 GElf_Shdr *symshdr = gelf_getshdr (symscn, &symshdr_mem);
    889 Elf_Data *symdata = elf_getdata (symscn, NULL);
    890
    891 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    892 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    893 {
    894 GElf_Rel rel_mem;
    895 GElf_Rel *rel;
    896 @@ -1341,7 +1354,8 @@ section [%2d] '%s': referenced as string
    897 shdr->sh_link, section_name (ebl, shdr->sh_link),
    898 idx, section_name (ebl, idx));
    899
    900 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
    901 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
    902 + if (shdr->sh_entsize != sh_entsize)
    903 ERROR (gettext ("\
    904 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
    905 idx, section_name (ebl, idx));
    906 @@ -1351,7 +1365,7 @@ section [%2d] '%s': section entry size d
    907 idx, section_name (ebl, idx));
    908
    909 bool non_null_warned = false;
    910 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    911 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    912 {
    913 GElf_Dyn dyn_mem;
    914 GElf_Dyn *dyn;
    915 @@ -1502,6 +1516,8 @@ section [%2d] '%s': entry size does not
    916 idx, section_name (ebl, idx));
    917
    918 if (symshdr != NULL
    919 + && shdr->sh_entsize
    920 + && symshdr->sh_entsize
    921 && (shdr->sh_size / shdr->sh_entsize
    922 < symshdr->sh_size / symshdr->sh_entsize))
    923 ERROR (gettext ("\
    924 @@ -1530,6 +1546,12 @@ section [%2d] '%s': extended section ind
    925 }
    926
    927 data = elf_getdata (scn, NULL);
    928 + if (data == NULL)
    929 + {
    930 + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
    931 + idx, section_name (ebl, idx));
    932 + return;
    933 + }
    934
    935 if (*((Elf32_Word *) data->d_buf) != 0)
    936 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
    937 @@ -1613,7 +1635,7 @@ section [%2d] '%s': hash table section i
    938 idx, section_name (ebl, idx), (long int) shdr->sh_size,
    939 (long int) ((2 + nbucket + nchain) * shdr->sh_entsize));
    940
    941 - if (symshdr != NULL)
    942 + if (symshdr != NULL && symshdr->sh_entsize)
    943 {
    944 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
    945 size_t cnt;
    946 @@ -1910,8 +1932,10 @@ section [%2d] '%s' refers in sh_link to
    947 return;
    948 }
    949
    950 - if (shdr->sh_size / shdr->sh_entsize
    951 - != symshdr->sh_size / symshdr->sh_entsize)
    952 + if (shdr->sh_entsize
    953 + && symshdr->sh_entsize
    954 + && shdr->sh_size / shdr->sh_entsize
    955 + != symshdr->sh_size / symshdr->sh_entsize)
    956 ERROR (gettext ("\
    957 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
    958 idx, section_name (ebl, idx),
    959
    960 --- elfutils-0.108/libelf/elf32_getphdr.c.jj 2005-02-06 10:14:52.000000000 +0100
    961 +++ elfutils-0.108/libelf/elf32_getphdr.c 2005-05-17 16:53:41.000000000 +0200
    962 @@ -80,6 +80,16 @@ elfw2(LIBELFBITS,getphdr) (elf)
    963
    964 if (elf->map_address != NULL)
    965 {
    966 + /* First see whether the information in the ELF header is
    967 + valid and it does not ask for too much. */
    968 + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
    969 + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
    970 + {
    971 + /* Something is wrong. */
    972 + __libelf_seterrno (ELF_E_INVALID_PHDR);
    973 + goto out;
    974 + }
    975 +
    976 /* All the data is already mapped. Use it. */
    977 if (ehdr->e_ident[EI_DATA] == MY_ELFDATA
    978 && (ALLOW_UNALIGNED
    979 --- elfutils-0.108/libelf/elf_getshstrndx.c.jj 2004-01-05 21:45:05.000000000 +0100
    980 +++ elfutils-0.108/libelf/elf_getshstrndx.c 2005-05-17 15:42:32.000000000 +0200
    981 @@ -1,5 +1,5 @@
    982 /* Return section index of section header string table.
    983 - Copyright (C) 2002 Red Hat, Inc.
    984 + Copyright (C) 2002, 2005 Red Hat, Inc.
    985 Written by Ulrich Drepper <drepper@redhat.com>, 2002.
    986
    987 This program is free software; you can redistribute it and/or modify
    988 @@ -90,10 +90,25 @@ elf_getshstrndx (elf, dst)
    989 if (elf->map_address != NULL
    990 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    991 && (ALLOW_UNALIGNED
    992 - || (((size_t) ((char *) elf->map_address + offset))
    993 + || (((size_t) ((char *) elf->map_address
    994 + + elf->start_offset + offset))
    995 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
    996 - /* We can directly access the memory. */
    997 - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
    998 + {
    999 + /* First see whether the information in the ELF header is
    1000 + valid and it does not ask for too much. */
    1001 + if (unlikely (offset + sizeof (Elf32_Shdr)
    1002 + > elf->maximum_size))
    1003 + {
    1004 + /* Something is wrong. */
    1005 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1006 + result = -1;
    1007 + goto out;
    1008 + }
    1009 +
    1010 + /* We can directly access the memory. */
    1011 + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
    1012 + + offset))->sh_link;
    1013 + }
    1014 else
    1015 {
    1016 /* We avoid reading in all the section headers. Just read
    1017 @@ -129,10 +144,25 @@ elf_getshstrndx (elf, dst)
    1018 if (elf->map_address != NULL
    1019 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    1020 && (ALLOW_UNALIGNED
    1021 - || (((size_t) ((char *) elf->map_address + offset))
    1022 + || (((size_t) ((char *) elf->map_address
    1023 + + elf->start_offset + offset))
    1024 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
    1025 - /* We can directly access the memory. */
    1026 - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
    1027 + {
    1028 + /* First see whether the information in the ELF header is
    1029 + valid and it does not ask for too much. */
    1030 + if (unlikely (offset + sizeof (Elf64_Shdr)
    1031 + > elf->maximum_size))
    1032 + {
    1033 + /* Something is wrong. */
    1034 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1035 + result = -1;
    1036 + goto out;
    1037 + }
    1038 +
    1039 + /* We can directly access the memory. */
    1040 + num = ((Elf64_Shdr *) (elf->map_address
    1041 + + elf->start_offset + offset))->sh_link;
    1042 + }
    1043 else
    1044 {
    1045 /* We avoid reading in all the section headers. Just read
    1046 --- elfutils-0.108/libelf/elf32_getshdr.c.jj 2005-05-14 00:32:57.000000000 +0200
    1047 +++ elfutils-0.108/libelf/elf32_getshdr.c 2005-05-17 15:27:52.000000000 +0200
    1048 @@ -71,7 +71,7 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1049 goto out;
    1050 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
    1051
    1052 - /* Allocate memory for the program headers. We know the number
    1053 + /* Allocate memory for the section headers. We know the number
    1054 of entries from the ELF header. */
    1055 ElfW2(LIBELFBITS,Shdr) *shdr = elf->state.ELFW(elf,LIBELFBITS).shdr =
    1056 (ElfW2(LIBELFBITS,Shdr) *) malloc (size);
    1057 @@ -93,6 +93,16 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1058 && (ehdr->e_shoff
    1059 & (__alignof__ (ElfW2(LIBELFBITS,Shdr)) - 1)) != 0));
    1060
    1061 + /* First see whether the information in the ELF header is
    1062 + valid and it does not ask for too much. */
    1063 + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
    1064 + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
    1065 + {
    1066 + /* Something is wrong. */
    1067 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1068 + goto free_and_out;
    1069 + }
    1070 +
    1071 /* Now copy the data and at the same time convert the byte
    1072 order. */
    1073 if (ALLOW_UNALIGNED
    1074 --- elfutils-0.108/libelf/elf_begin.c.jj 2005-05-17 16:18:51.000000000 +0200
    1075 +++ elfutils-0.108/libelf/elf_begin.c 2005-05-17 17:31:37.000000000 +0200
    1076 @@ -77,7 +77,11 @@ get_shnum (void *map_address, unsigned c
    1077 || (((size_t) ((char *) map_address + offset))
    1078 & ((is32 ? __alignof__ (Elf32_Ehdr) : __alignof__ (Elf64_Ehdr))
    1079 - 1)) == 0))
    1080 - ehdr.p = (char *) map_address + offset;
    1081 + {
    1082 + ehdr.p = (char *) map_address + offset;
    1083 + if (maxsize < (is32 ? sizeof (Elf32_Ehdr) : sizeof (Elf64_Ehdr)))
    1084 + return (size_t) -1l;
    1085 + }
    1086 else
    1087 {
    1088 /* We have to read the data from the file. */
    1089 @@ -111,7 +115,8 @@ get_shnum (void *map_address, unsigned c
    1090
    1091 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
    1092 {
    1093 - if (offset + ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
    1094 + if (unlikely (ehdr.e32->e_shoff >= maxsize)
    1095 + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
    1096 /* Cannot read the first section header. */
    1097 return (size_t) -1l;
    1098
    1099 @@ -147,7 +152,8 @@ get_shnum (void *map_address, unsigned c
    1100
    1101 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
    1102 {
    1103 - if (offset + ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
    1104 + if (unlikely (ehdr.e64->e_shoff >= maxsize)
    1105 + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
    1106 /* Cannot read the first section header. */
    1107 return (size_t) -1l;
    1108
    1109 @@ -224,6 +226,15 @@ file_read_elf (int fildes, void *map_add
    1110 /* Could not determine the number of sections. */
    1111 return NULL;
    1112
    1113 + /* Check for too many sections. */
    1114 + if (e_ident[EI_CLASS] == ELFCLASS32)
    1115 + {
    1116 + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
    1117 + return NULL;
    1118 + }
    1119 + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
    1120 + return NULL;
    1121 +
    1122 /* We can now allocate the memory. */
    1123 elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
    1124 ELF_K_ELF, scncnt * sizeof (Elf_Scn));
    1125 @@ -255,15 +270,31 @@ file_read_elf (int fildes, void *map_add
    1126 /* We can use the mmapped memory. */
    1127 elf->state.elf32.ehdr =
    1128 (Elf32_Ehdr *) ((char *) map_address + offset);
    1129 + if (unlikely (elf->state.elf32.ehdr->e_shoff >= maxsize)
    1130 + || unlikely (elf->state.elf32.ehdr->e_shoff
    1131 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
    1132 + {
    1133 + free_and_out:
    1134 + __libelf_seterrno (ELF_E_INVALID_FILE);
    1135 + free (elf);
    1136 + return NULL;
    1137 + }
    1138 elf->state.elf32.shdr =
    1139 (Elf32_Shdr *) ((char *) map_address + offset
    1140 + elf->state.elf32.ehdr->e_shoff);
    1141 if (elf->state.elf32.ehdr->e_phnum)
    1142 - /* Assign a value only if there really is a program
    1143 - header. Otherwise the value remains NULL. */
    1144 - elf->state.elf32.phdr
    1145 - = (Elf32_Phdr *) ((char *) map_address + offset
    1146 - + elf->state.elf32.ehdr->e_phoff);
    1147 + {
    1148 + /* Assign a value only if there really is a program
    1149 + header. Otherwise the value remains NULL. */
    1150 + if (unlikely (elf->state.elf32.ehdr->e_phoff >= maxsize)
    1151 + || unlikely (elf->state.elf32.ehdr->e_phoff
    1152 + + elf->state.elf32.ehdr->e_phnum
    1153 + * sizeof (Elf32_Phdr) > maxsize))
    1154 + goto free_and_out;
    1155 + elf->state.elf32.phdr
    1156 + = (Elf32_Phdr *) ((char *) map_address + offset
    1157 + + elf->state.elf32.ehdr->e_phoff);
    1158 + }
    1159
    1160 for (size_t cnt = 0; cnt < scncnt; ++cnt)
    1161 {
    1162 @@ -285,8 +316,7 @@ file_read_elf (int fildes, void *map_add
    1163 sizeof (Elf32_Ehdr), offset) != sizeof (Elf32_Ehdr))
    1164 {
    1165 /* We must be able to read the ELF header. */
    1166 - __libelf_seterrno (ELF_E_INVALID_FILE);
    1167 - return NULL;
    1168 + goto free_and_out;
    1169 }
    1170
    1171 if (e_ident[EI_DATA] != MY_ELFDATA)
    1172 @@ -340,15 +370,26 @@ file_read_elf (int fildes, void *map_add
    1173 /* We can use the mmapped memory. */
    1174 elf->state.elf64.ehdr =
    1175 (Elf64_Ehdr *) ((char *) map_address + offset);
    1176 + if (unlikely (elf->state.elf64.ehdr->e_shoff >= maxsize)
    1177 + || unlikely (elf->state.elf64.ehdr->e_shoff
    1178 + + scncnt * sizeof (Elf64_Shdr) > maxsize))
    1179 + goto free_and_out;
    1180 elf->state.elf64.shdr =
    1181 (Elf64_Shdr *) ((char *) map_address + offset
    1182 + elf->state.elf64.ehdr->e_shoff);
    1183 if (elf->state.elf64.ehdr->e_phnum)
    1184 - /* Assign a value only if there really is a program
    1185 - header. Otherwise the value remains NULL. */
    1186 - elf->state.elf64.phdr
    1187 - = (Elf64_Phdr *) ((char *) map_address + offset
    1188 - + elf->state.elf64.ehdr->e_phoff);
    1189 + {
    1190 + /* Assign a value only if there really is a program
    1191 + header. Otherwise the value remains NULL. */
    1192 + if (unlikely (elf->state.elf64.ehdr->e_phoff >= maxsize)
    1193 + || unlikely (elf->state.elf64.ehdr->e_phoff
    1194 + + elf->state.elf64.ehdr->e_phnum
    1195 + * sizeof (Elf64_Phdr) > maxsize))
    1196 + goto free_and_out;
    1197 + elf->state.elf64.phdr
    1198 + = (Elf64_Phdr *) ((char *) map_address + offset
    1199 + + elf->state.elf64.ehdr->e_phoff);
    1200 + }
    1201
    1202 for (size_t cnt = 0; cnt < scncnt; ++cnt)
    1203 {
    1204 @@ -370,8 +411,7 @@ file_read_elf (int fildes, void *map_add
    1205 sizeof (Elf64_Ehdr), offset) != sizeof (Elf64_Ehdr))
    1206 {
    1207 /* We must be able to read the ELF header. */
    1208 - __libelf_seterrno (ELF_E_INVALID_FILE);
    1209 - return NULL;
    1210 + goto free_and_out;
    1211 }
    1212
    1213 if (e_ident[EI_DATA] != MY_ELFDATA)
    1214 --- elfutils-0.108/src/elflint.c.jj 2005-05-14 02:22:24.000000000 +0200
    1215 +++ elfutils-0.108/src/elflint.c 2005-05-17 18:02:00.000000000 +0200
    1216 @@ -309,6 +309,8 @@ section_name (Ebl *ebl, int idx)
    1217 return "<invalid>";
    1218
    1219 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
    1220 + if (shdr == NULL)
    1221 + return "<invalid>";
    1222
    1223 ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    1224 if (ret == NULL)
    1225 @@ -1639,19 +1641,26 @@ section [%2d] '%s': hash table section i
    1226 {
    1227 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
    1228 size_t cnt;
    1229 + Elf32_Word *buf, *end;
    1230
    1231 if (nchain < symshdr->sh_size / symshdr->sh_entsize)
    1232 ERROR (gettext ("section [%2d] '%s': chain array not large enough\n"),
    1233 idx, section_name (ebl, idx));
    1234
    1235 + buf = ((Elf32_Word *) data->d_buf) + 2;
    1236 + end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
    1237 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
    1238 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
    1239 + if (buf >= end)
    1240 + return;
    1241 + else if (*buf++ >= symsize)
    1242 ERROR (gettext ("\
    1243 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
    1244 idx, section_name (ebl, idx), cnt - 2);
    1245
    1246 for (; cnt < 2 + nbucket + nchain; ++cnt)
    1247 - if (((Elf32_Word *) data->d_buf)[cnt] >= symsize)
    1248 + if (buf >= end)
    1249 + return;
    1250 + else if (*buf++ >= symsize)
    1251 ERROR (gettext ("\
    1252 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
    1253 idx, section_name (ebl, idx), cnt - 2 - nbucket);
    1254 @@ -2311,6 +2320,8 @@ phdr[%d]: no note entries defined for th
    1255 return;
    1256
    1257 char *notemem = gelf_rawchunk (ebl->elf, phdr->p_offset, phdr->p_filesz);
    1258 + if (notemem == NULL)
    1259 + return;
    1260
    1261 /* ELF64 files often use note section entries in the 32-bit format.
    1262 The p_align field is set to 8 in case the 64-bit format is used.
    1263
    1264 --- elfutils/src/strip.c
    1265 +++ elfutils/src/strip.c
    1266 @@ -400,6 +400,7 @@ handle_elf (int fd, Elf *elf, const char
    1267 Elf_Data debuglink_crc_data;
    1268 bool any_symtab_changes = false;
    1269 Elf_Data *shstrtab_data = NULL;
    1270 + size_t shdridx = 0;
    1271
    1272 /* Create the full name of the file. */
    1273 if (prefix != NULL)
    1274 @@ -531,6 +532,11 @@ handle_elf (int fd, Elf *elf, const char
    1275 goto fail_close;
    1276 }
    1277
    1278 + if (shstrndx >= shnum)
    1279 + goto illformed;
    1280 +
    1281 +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
    1282 +
    1283 /* Storage for section information. We leave room for two more
    1284 entries since we unconditionally create a section header string
    1285 table. Maybe some weird tool created an ELF file without one.
    1286 @@ -552,7 +558,7 @@ handle_elf (int fd, Elf *elf, const char
    1287 {
    1288 /* This should always be true (i.e., there should not be any
    1289 holes in the numbering). */
    1290 - assert (elf_ndxscn (scn) == cnt);
    1291 + elf_assert (elf_ndxscn (scn) == cnt);
    1292
    1293 shdr_info[cnt].scn = scn;
    1294
    1295 @@ -565,6 +571,7 @@ handle_elf (int fd, Elf *elf, const char
    1296 shdr_info[cnt].shdr.sh_name);
    1297 if (shdr_info[cnt].name == NULL)
    1298 {
    1299 + illformed:
    1300 error (0, 0, gettext ("illformed file '%s'"), fname);
    1301 goto fail_close;
    1302 }
    1303 @@ -574,6 +581,8 @@ handle_elf (int fd, Elf *elf, const char
    1304
    1305 /* Remember the shdr.sh_link value. */
    1306 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
    1307 + if (shdr_info[cnt].old_sh_link >= shnum)
    1308 + goto illformed;
    1309
    1310 /* Sections in files other than relocatable object files which
    1311 are not loaded can be freely moved by us. In relocatable
    1312 @@ -586,7 +595,7 @@ handle_elf (int fd, Elf *elf, const char
    1313 appropriate reference. */
    1314 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
    1315 {
    1316 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    1317 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    1318 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
    1319 }
    1320 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
    1321 @@ -605,7 +614,12 @@ handle_elf (int fd, Elf *elf, const char
    1322 for (inner = 1;
    1323 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
    1324 ++inner)
    1325 - shdr_info[grpref[inner]].group_idx = cnt;
    1326 + {
    1327 + if (grpref[inner] < shnum)
    1328 + shdr_info[grpref[inner]].group_idx = cnt;
    1329 + else
    1330 + goto illformed;
    1331 + }
    1332
    1333 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
    1334 /* If the section group contains only one element and this
    1335 @@ -616,7 +630,7 @@ handle_elf (int fd, Elf *elf, const char
    1336 }
    1337 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
    1338 {
    1339 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    1340 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    1341 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
    1342 }
    1343
    1344 @@ -624,7 +638,7 @@ handle_elf (int fd, Elf *elf, const char
    1345 discarded right away. */
    1346 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
    1347 {
    1348 - assert (shdr_info[cnt].group_idx != 0);
    1349 + elf_assert (shdr_info[cnt].group_idx != 0);
    1350
    1351 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
    1352 {
    1353 @@ -700,10 +714,14 @@ handle_elf (int fd, Elf *elf, const char
    1354 {
    1355 /* If a relocation section is marked as being removed make
    1356 sure the section it is relocating is removed, too. */
    1357 - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
    1358 - || shdr_info[cnt].shdr.sh_type == SHT_RELA)
    1359 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    1360 - shdr_info[cnt].idx = 1;
    1361 + if (shdr_info[cnt].shdr.sh_type == SHT_REL
    1362 + || shdr_info[cnt].shdr.sh_type == SHT_RELA)
    1363 + {
    1364 + if (shdr_info[cnt].shdr.sh_info >= shnum)
    1365 + goto illformed;
    1366 + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    1367 + shdr_info[cnt].idx = 1;
    1368 + }
    1369 }
    1370
    1371 if (shdr_info[cnt].idx == 1)
    1372 @@ -733,7 +751,7 @@ handle_elf (int fd, Elf *elf, const char
    1373 if (shdr_info[cnt].symtab_idx != 0
    1374 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
    1375 {
    1376 - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    1377 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    1378
    1379 shdr_info[shdr_info[cnt].symtab_idx].data
    1380 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    1381 @@ -773,6 +791,9 @@ handle_elf (int fd, Elf *elf, const char
    1382 else if (scnidx == SHN_XINDEX)
    1383 scnidx = xndx;
    1384
    1385 + if (scnidx >= shnum)
    1386 + goto illformed;
    1387 +
    1388 if (shdr_info[scnidx].idx == 0)
    1389 {
    1390 /* Mark this section as used. */
    1391 @@ -804,11 +825,15 @@ handle_elf (int fd, Elf *elf, const char
    1392 }
    1393
    1394 /* Handle references through sh_info. */
    1395 - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
    1396 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    1397 + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
    1398 {
    1399 - shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
    1400 - changes |= shdr_info[cnt].shdr.sh_info < cnt;
    1401 + if (shdr_info[cnt].shdr.sh_info >= shnum)
    1402 + goto illformed;
    1403 + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    1404 + {
    1405 + shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
    1406 + changes |= shdr_info[cnt].shdr.sh_info < cnt;
    1407 + }
    1408 }
    1409
    1410 /* Mark the section as investigated. */
    1411 @@ -911,7 +936,7 @@ handle_elf (int fd, Elf *elf, const char
    1412 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
    1413 elf_errmsg (-1));
    1414
    1415 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1416 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1417
    1418 /* Add this name to the section header string table. */
    1419 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
    1420 @@ -951,7 +976,7 @@ handle_elf (int fd, Elf *elf, const char
    1421 error (EXIT_FAILURE, 0,
    1422 gettext ("while create section header section: %s"),
    1423 elf_errmsg (-1));
    1424 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1425 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    1426
    1427 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
    1428 if (shdr_info[cnt].data == NULL)
    1429 @@ -982,7 +1007,7 @@ handle_elf (int fd, Elf *elf, const char
    1430 }
    1431
    1432 /* Index of the section header table in the shdr_info array. */
    1433 - size_t shdridx = cnt;
    1434 + shdridx = cnt;
    1435
    1436 /* Add the section header string table section name. */
    1437 shdr_info[cnt].se = ebl_strtabadd (shst, ".shstrtab", 10);
    1438 @@ -1007,7 +1032,7 @@ handle_elf (int fd, Elf *elf, const char
    1439 error (EXIT_FAILURE, 0,
    1440 gettext ("while create section header section: %s"),
    1441 elf_errmsg (-1));
    1442 - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    1443 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    1444
    1445 /* Finalize the string table and fill in the correct indices in the
    1446 section headers. */
    1447 @@ -1097,21 +1122,21 @@ handle_elf (int fd, Elf *elf, const char
    1448 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    1449 NULL);
    1450
    1451 - assert ((versiondata->d_size / sizeof (Elf32_Word))
    1452 - >= shdr_info[cnt].data->d_size / elsize);
    1453 + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
    1454 + >= shdr_info[cnt].data->d_size / elsize);
    1455 }
    1456
    1457 if (shdr_info[cnt].version_idx != 0)
    1458 {
    1459 - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    1460 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    1461 /* This section has associated version
    1462 information. We have to modify that
    1463 information, too. */
    1464 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
    1465 NULL);
    1466
    1467 - assert ((versiondata->d_size / sizeof (GElf_Versym))
    1468 - >= shdr_info[cnt].data->d_size / elsize);
    1469 + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
    1470 + >= shdr_info[cnt].data->d_size / elsize);
    1471 }
    1472
    1473 shdr_info[cnt].newsymidx
    1474 @@ -1165,7 +1190,7 @@ handle_elf (int fd, Elf *elf, const char
    1475 sec = shdr_info[sym->st_shndx].idx;
    1476 else
    1477 {
    1478 - assert (shndxdata != NULL);
    1479 + elf_assert (shndxdata != NULL);
    1480
    1481 sec = shdr_info[xshndx].idx;
    1482 }
    1483 @@ -1186,7 +1211,7 @@ handle_elf (int fd, Elf *elf, const char
    1484 nxshndx = sec;
    1485 }
    1486
    1487 - assert (sec < SHN_LORESERVE || shndxdata != NULL);
    1488 + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
    1489
    1490 if ((inner != destidx || nshndx != sym->st_shndx
    1491 || (shndxdata != NULL && nxshndx != xshndx))
    1492 @@ -1209,7 +1234,7 @@ handle_elf (int fd, Elf *elf, const char
    1493 else
    1494 /* This is a section symbol for a section which has
    1495 been removed. */
    1496 - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    1497 + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    1498 }
    1499
    1500 if (destidx != inner)
    1501 @@ -1373,11 +1398,11 @@ handle_elf (int fd, Elf *elf, const char
    1502 {
    1503 GElf_Sym sym_mem;
    1504 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    1505 - assert (sym != NULL);
    1506 + elf_assert (sym != NULL);
    1507
    1508 const char *name = elf_strptr (elf, strshndx,
    1509 sym->st_name);
    1510 - assert (name != NULL);
    1511 + elf_assert (name != NULL);
    1512 size_t hidx = elf_hash (name) % nbucket;
    1513
    1514 if (bucket[hidx] == 0)
    1515 @@ -1396,8 +1421,8 @@ handle_elf (int fd, Elf *elf, const char
    1516 else
    1517 {
    1518 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
    1519 - assert (shdr_info[cnt].shdr.sh_entsize
    1520 - == sizeof (Elf64_Xword));
    1521 + elf_assert (shdr_info[cnt].shdr.sh_entsize
    1522 + == sizeof (Elf64_Xword));
    1523
    1524 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
    1525
    1526 @@ -1430,11 +1455,11 @@ handle_elf (int fd, Elf *elf, const char
    1527 {
    1528 GElf_Sym sym_mem;
    1529 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    1530 - assert (sym != NULL);
    1531 + elf_assert (sym != NULL);
    1532
    1533 const char *name = elf_strptr (elf, strshndx,
    1534 sym->st_name);
    1535 - assert (name != NULL);
    1536 + elf_assert (name != NULL);
    1537 size_t hidx = elf_hash (name) % nbucket;
    1538
    1539 if (bucket[hidx] == 0)
    1540 --- elfutils/src/readelf.c
    1541 +++ elfutils/src/readelf.c
    1542 @@ -947,6 +947,7 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1543 GElf_Shdr *symshdr;
    1544 Elf_Data *symdata;
    1545 GElf_Sym sym_mem;
    1546 + GElf_Sym *sym;
    1547 size_t cnt;
    1548 size_t shstrndx;
    1549
    1550 @@ -966,6 +967,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1551 error (EXIT_FAILURE, 0,
    1552 gettext ("cannot get section header string table index"));
    1553
    1554 + sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
    1555 +
    1556 grpref = (Elf32_Word *) data->d_buf;
    1557
    1558 printf ((grpref[0] & GRP_COMDAT)
    1559 @@ -980,8 +983,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    1560 data->d_size / sizeof (Elf32_Word) - 1),
    1561 elf_ndxscn (scn),
    1562 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
    1563 - elf_strptr (ebl->elf, symshdr->sh_link,
    1564 - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
    1565 + (sym == NULL ? NULL
    1566 + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
    1567 ?: gettext ("<INVALID SYMBOL>"),
    1568 data->d_size / sizeof (Elf32_Word) - 1);
    1569
    1570 @@ -1135,7 +1138,8 @@ static void
    1571 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
    1572 {
    1573 int class = gelf_getclass (ebl->elf);
    1574 - GElf_Shdr glink;
    1575 + GElf_Shdr glink_mem;
    1576 + GElf_Shdr *glink;
    1577 Elf_Data *data;
    1578 size_t cnt;
    1579 size_t shstrndx;
    1580 @@ -1150,6 +1154,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    1581 error (EXIT_FAILURE, 0,
    1582 gettext ("cannot get section header string table index"));
    1583
    1584 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1585 + if (glink == NULL)
    1586 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1587 + elf_ndxscn (scn));
    1588 +
    1589 printf (ngettext ("\
    1590 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1591 "\
    1592 @@ -1159,9 +1168,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    1593 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1594 shdr->sh_offset,
    1595 (int) shdr->sh_link,
    1596 - elf_strptr (ebl->elf, shstrndx,
    1597 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1598 - &glink)->sh_name));
    1599 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1600 fputs_unlocked (gettext (" Type Value\n"), stdout);
    1601
    1602 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    1603 @@ -1656,7 +1663,8 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1604 unsigned int cnt;
    1605 Elf32_Word verneed_stridx = 0;
    1606 Elf32_Word verdef_stridx = 0;
    1607 - GElf_Shdr glink;
    1608 + GElf_Shdr glink_mem;
    1609 + GElf_Shdr *glink;
    1610 size_t shstrndx;
    1611
    1612 /* Get the data of the section. */
    1613 @@ -1701,6 +1709,11 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1614 error (EXIT_FAILURE, 0,
    1615 gettext ("cannot get section header string table index"));
    1616
    1617 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1618 + if (glink == NULL)
    1619 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1620 + elf_ndxscn (scn));
    1621 +
    1622 /* Now we can compute the number of entries in the section. */
    1623 nsyms = data->d_size / (class == ELFCLASS32
    1624 ? sizeof (Elf32_Sym) : sizeof (Elf64_Sym));
    1625 @@ -1715,9 +1728,7 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    1626 shdr->sh_info),
    1627 (unsigned long int) shdr->sh_info,
    1628 (unsigned int) shdr->sh_link,
    1629 - elf_strptr (ebl->elf, shstrndx,
    1630 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1631 - &glink)->sh_name));
    1632 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1633
    1634 fputs_unlocked (class == ELFCLASS32
    1635 ? gettext ("\
    1636 @@ -1945,7 +1956,8 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1637 {
    1638 Elf_Data *data;
    1639 int class = gelf_getclass (ebl->elf);
    1640 - GElf_Shdr glink;
    1641 + GElf_Shdr glink_mem;
    1642 + GElf_Shdr *glink;
    1643 int cnt;
    1644 unsigned int offset;
    1645 size_t shstrndx;
    1646 @@ -1960,6 +1972,11 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1647 error (EXIT_FAILURE, 0,
    1648 gettext ("cannot get section header string table index"));
    1649
    1650 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1651 + if (glink == NULL)
    1652 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1653 + elf_ndxscn (scn));
    1654 +
    1655 printf (ngettext ("\
    1656 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1657 "\
    1658 @@ -1970,9 +1987,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    1659 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1660 shdr->sh_offset,
    1661 (unsigned int) shdr->sh_link,
    1662 - elf_strptr (ebl->elf, shstrndx,
    1663 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1664 - &glink)->sh_name));
    1665 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1666
    1667 offset = 0;
    1668 for (cnt = shdr->sh_info; --cnt >= 0; )
    1669 @@ -2022,7 +2037,8 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1670 {
    1671 Elf_Data *data;
    1672 int class = gelf_getclass (ebl->elf);
    1673 - GElf_Shdr glink;
    1674 + GElf_Shdr glink_mem;
    1675 + GElf_Shdr *glink;
    1676 int cnt;
    1677 unsigned int offset;
    1678 size_t shstrndx;
    1679 @@ -2037,6 +2053,11 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1680 error (EXIT_FAILURE, 0,
    1681 gettext ("cannot get section header string table index"));
    1682
    1683 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1684 + if (glink == NULL)
    1685 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1686 + elf_ndxscn (scn));
    1687 +
    1688 printf (ngettext ("\
    1689 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    1690 "\
    1691 @@ -2048,9 +2069,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    1692 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1693 shdr->sh_offset,
    1694 (unsigned int) shdr->sh_link,
    1695 - elf_strptr (ebl->elf, shstrndx,
    1696 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1697 - &glink)->sh_name));
    1698 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1699
    1700 offset = 0;
    1701 for (cnt = shdr->sh_info; --cnt >= 0; )
    1702 @@ -2106,7 +2125,8 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1703 Elf_Data *data;
    1704 int class = gelf_getclass (ebl->elf);
    1705 Elf_Scn *verscn;
    1706 - GElf_Shdr glink;
    1707 + GElf_Shdr glink_mem;
    1708 + GElf_Shdr *glink;
    1709 Elf_Scn *defscn;
    1710 Elf_Scn *needscn;
    1711 const char **vername;
    1712 @@ -2125,6 +2145,11 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1713 error (EXIT_FAILURE, 0,
    1714 gettext ("cannot get section header string table index"));
    1715
    1716 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    1717 + if (glink == NULL)
    1718 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    1719 + elf_ndxscn (scn));
    1720 +
    1721 /* We have to find the version definition section and extract the
    1722 version names. */
    1723 defscn = NULL;
    1724 @@ -2347,9 +2372,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    1725 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    1726 shdr->sh_offset,
    1727 (unsigned int) shdr->sh_link,
    1728 - elf_strptr (ebl->elf, shstrndx,
    1729 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1730 - &glink)->sh_name));
    1731 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1732
    1733 /* Now we can finally look at the actual contents of this section. */
    1734 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    1735 @@ -2425,7 +2448,8 @@ handle_hash (Ebl *ebl)
    1736 Elf32_Word maxlength = 0;
    1737 Elf32_Word nsyms = 0;
    1738 uint64_t nzero_counts = 0;
    1739 - GElf_Shdr glink;
    1740 + GElf_Shdr glink_mem;
    1741 + GElf_Shdr *glink;
    1742
    1743 if (data == NULL)
    1744 {
    1745 @@ -2434,6 +2458,16 @@ handle_hash (Ebl *ebl)
    1746 continue;
    1747 }
    1748
    1749 +
    1750 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    1751 + &glink_mem);
    1752 + if (glink == NULL)
    1753 + {
    1754 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
    1755 + elf_ndxscn (scn));
    1756 + continue;
    1757 + }
    1758 +
    1759 nbucket = ((Elf32_Word *) data->d_buf)[0];
    1760 nchain = ((Elf32_Word *) data->d_buf)[1];
    1761 bucket = &((Elf32_Word *) data->d_buf)[2];
    1762 @@ -2451,10 +2485,7 @@ handle_hash (Ebl *ebl)
    1763 shdr->sh_addr,
    1764 shdr->sh_offset,
    1765 (unsigned int) shdr->sh_link,
    1766 - elf_strptr (ebl->elf, shstrndx,
    1767 - gelf_getshdr (elf_getscn (ebl->elf,
    1768 - shdr->sh_link),
    1769 - &glink)->sh_name));
    1770 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    1771
    1772 lengths = (uint32_t *) xcalloc (nbucket, sizeof (uint32_t));
    1773