Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/elfutils/patches/elfutils-0.131-robustify.patch

    Contents of /trunk/elfutils/patches/elfutils-0.131-robustify.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 573 - (show annotations) (download)
    Sun Apr 20 23:45:45 2008 UTC (16 years ago) by niro
    File size: 56166 byte(s) 
    -re-diffed
    1 src/
    2 2005-06-09 Roland McGrath <roland@redhat.com>
    3
    4 * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
    5 (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
    6 (handle_scngrp): Check for bogus sh_info.
    7
    8 * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
    9 st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
    10 Don't use assert on input values, instead bail with "illformed" error.
    11
    12 2005-05-17 Jakub Jelinek <jakub@redhat.com>
    13
    14 libelf/
    15 * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
    16 table fits into object's bounds.
    17 * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
    18 elf->map_address. Check if first section header fits into object's
    19 bounds.
    20 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)):
    21 Check if section header table fits into object's bounds.
    22 * elf_begin.c (get_shnum): Ensure section headers fits into
    23 object's bounds.
    24 (file_read_elf): Make sure scncnt is small enough to allocate both
    25 ElfXX_Shdr and Elf_Scn array. Make sure section and program header
    26 tables fit into object's bounds. Avoid memory leak on failure.
    27
    28 src/
    29 * elflint.c (check_hash): Don't check entries beyond end of section.
    30 (check_note): Don't crash if gelf_rawchunk fails.
    31 (section_name): Return <invalid> if gelf_getshdr returns NULL.
    32
    33 2005-05-14 Jakub Jelinek <jakub@redhat.com>
    34
    35 libelf/
    36 * libelfP.h (INVALID_NDX): Define.
    37 * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
    38 * gelf_getlib.c (gelf_getlib): Likewise.
    39 * gelf_getmove.c (gelf_getmove): Likewise.
    40 * gelf_getrel.c (gelf_getrel): Likewise.
    41 * gelf_getrela.c (gelf_getrela): Likewise.
    42 * gelf_getsym.c (gelf_getsym): Likewise.
    43 * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
    44 * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
    45 * gelf_getversym.c (gelf_getversym): Likewise.
    46 * gelf_update_dyn.c (gelf_update_dyn): Likewise.
    47 * gelf_update_lib.c (gelf_update_lib): Likewise.
    48 * gelf_update_move.c (gelf_update_move): Likewise.
    49 * gelf_update_rel.c (gelf_update_rel): Likewise.
    50 * gelf_update_rela.c (gelf_update_rela): Likewise.
    51 * gelf_update_sym.c (gelf_update_sym): Likewise.
    52 * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
    53 * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
    54 * gelf_update_versym.c (gelf_update_versym): Likewise.
    55 * elf_newscn.c (elf_newscn): Check for overflow.
    56 * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
    57 (__elfw2(LIBELFBITS,updatefile)): Likewise.
    58 * elf_begin.c (file_read_elf): Likewise.
    59 * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
    60 * elf_getarsym.c (elf_getarsym): Likewise.
    61 * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
    62 src/
    63 * elflint.c (section_name): Return "<invalid>" instead of
    64 crashing on invalid section name.
    65 (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
    66 check_symtab_shndx, check_hash, check_versym): Robustify.
    67
    68 --- elfutils-0.130/src/readelf.c.robustify
    69 +++ elfutils-0.130/src/readelf.c
    70 @@ -1053,6 +1053,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    71 Elf32_Word *grpref = (Elf32_Word *) data->d_buf;
    72
    73 GElf_Sym sym_mem;
    74 + GElf_Sym *sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
    75 +
    76 printf ((grpref[0] & GRP_COMDAT)
    77 ? ngettext ("\
    78 \nCOMDAT section group [%2zu] '%s' with signature '%s' contains %zu entry:\n",
    79 @@ -1065,8 +1067,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G
    80 data->d_size / sizeof (Elf32_Word) - 1),
    81 elf_ndxscn (scn),
    82 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
    83 - elf_strptr (ebl->elf, symshdr->sh_link,
    84 - gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
    85 + (sym == NULL ? NULL
    86 + : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
    87 ?: gettext ("<INVALID SYMBOL>"),
    88 data->d_size / sizeof (Elf32_Word) - 1);
    89
    90 @@ -1217,7 +1219,8 @@ static void
    91 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
    92 {
    93 int class = gelf_getclass (ebl->elf);
    94 - GElf_Shdr glink;
    95 + GElf_Shdr glink_mem;
    96 + GElf_Shdr *glink;
    97 Elf_Data *data;
    98 size_t cnt;
    99 size_t shstrndx;
    100 @@ -1232,6 +1235,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    101 error (EXIT_FAILURE, 0,
    102 gettext ("cannot get section header string table index"));
    103
    104 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    105 + if (glink == NULL)
    106 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    107 + elf_ndxscn (scn));
    108 +
    109 printf (ngettext ("\
    110 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    111 "\
    112 @@ -1241,9 +1249,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn,
    113 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    114 shdr->sh_offset,
    115 (int) shdr->sh_link,
    116 - elf_strptr (ebl->elf, shstrndx,
    117 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    118 - &glink)->sh_name));
    119 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    120 fputs_unlocked (gettext (" Type Value\n"), stdout);
    121
    122 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    123 @@ -1761,6 +1767,13 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    124 error (EXIT_FAILURE, 0,
    125 gettext ("cannot get section header string table index"));
    126
    127 + GElf_Shdr glink_mem;
    128 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    129 + &glink_mem);
    130 + if (glink == NULL)
    131 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    132 + elf_ndxscn (scn));
    133 +
    134 /* Now we can compute the number of entries in the section. */
    135 unsigned int nsyms = data->d_size / (class == ELFCLASS32
    136 ? sizeof (Elf32_Sym)
    137 @@ -1771,15 +1784,12 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G
    138 nsyms),
    139 (unsigned int) elf_ndxscn (scn),
    140 elf_strptr (ebl->elf, shstrndx, shdr->sh_name), nsyms);
    141 - GElf_Shdr glink;
    142 printf (ngettext (" %lu local symbol String table: [%2u] '%s'\n",
    143 " %lu local symbols String table: [%2u] '%s'\n",
    144 shdr->sh_info),
    145 (unsigned long int) shdr->sh_info,
    146 (unsigned int) shdr->sh_link,
    147 - elf_strptr (ebl->elf, shstrndx,
    148 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    149 - &glink)->sh_name));
    150 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    151
    152 fputs_unlocked (class == ELFCLASS32
    153 ? gettext ("\
    154 @@ -2015,7 +2025,13 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    155 error (EXIT_FAILURE, 0,
    156 gettext ("cannot get section header string table index"));
    157
    158 - GElf_Shdr glink;
    159 + GElf_Shdr glink_mem;
    160 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    161 + &glink_mem);
    162 + if (glink == NULL)
    163 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    164 + elf_ndxscn (scn));
    165 +
    166 printf (ngettext ("\
    167 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    168 "\
    169 @@ -2026,9 +2042,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn,
    170 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    171 shdr->sh_offset,
    172 (unsigned int) shdr->sh_link,
    173 - elf_strptr (ebl->elf, shstrndx,
    174 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    175 - &glink)->sh_name));
    176 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    177
    178 unsigned int offset = 0;
    179 for (int cnt = shdr->sh_info; --cnt >= 0; )
    180 @@ -2081,8 +2095,14 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    181 error (EXIT_FAILURE, 0,
    182 gettext ("cannot get section header string table index"));
    183
    184 + GElf_Shdr glink_mem;
    185 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    186 + &glink_mem);
    187 + if (glink == NULL)
    188 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    189 + elf_ndxscn (scn));
    190 +
    191 int class = gelf_getclass (ebl->elf);
    192 - GElf_Shdr glink;
    193 printf (ngettext ("\
    194 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    195 "\
    196 @@ -2094,9 +2114,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G
    197 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    198 shdr->sh_offset,
    199 (unsigned int) shdr->sh_link,
    200 - elf_strptr (ebl->elf, shstrndx,
    201 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    202 - &glink)->sh_name));
    203 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    204
    205 unsigned int offset = 0;
    206 for (int cnt = shdr->sh_info; --cnt >= 0; )
    207 @@ -2358,8 +2376,14 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    208 filename = NULL;
    209 }
    210
    211 + GElf_Shdr glink_mem;
    212 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    213 + &glink_mem);
    214 + if (glink == NULL)
    215 + error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
    216 + elf_ndxscn (scn));
    217 +
    218 /* Print the header. */
    219 - GElf_Shdr glink;
    220 printf (ngettext ("\
    221 \nVersion symbols section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'",
    222 "\
    223 @@ -2371,9 +2395,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G
    224 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
    225 shdr->sh_offset,
    226 (unsigned int) shdr->sh_link,
    227 - elf_strptr (ebl->elf, shstrndx,
    228 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    229 - &glink)->sh_name));
    230 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    231
    232 /* Now we can finally look at the actual contents of this section. */
    233 for (unsigned int cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    234 @@ -2425,7 +2447,17 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn,
    235 for (Elf32_Word cnt = 0; cnt < nbucket; ++cnt)
    236 ++counts[lengths[cnt]];
    237
    238 - GElf_Shdr glink;
    239 + GElf_Shdr glink_mem;
    240 + GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf,
    241 + shdr->sh_link),
    242 + &glink_mem);
    243 + if (glink == NULL)
    244 + {
    245 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
    246 + elf_ndxscn (scn));
    247 + return;
    248 + }
    249 +
    250 printf (ngettext ("\
    251 \nHistogram for bucket list length in section [%2u] '%s' (total of %d bucket):\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
    252 "\
    253 @@ -2438,9 +2470,7 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn,
    254 shdr->sh_addr,
    255 shdr->sh_offset,
    256 (unsigned int) shdr->sh_link,
    257 - elf_strptr (ebl->elf, shstrndx,
    258 - gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
    259 - &glink)->sh_name));
    260 + elf_strptr (ebl->elf, shstrndx, glink->sh_name));
    261
    262 if (extrastr != NULL)
    263 fputs (extrastr, stdout);
    264 @@ -3834,6 +3864,16 @@ print_debug_aranges_section (Dwfl_Module
    265 return;
    266 }
    267
    268 + GElf_Shdr glink_mem;
    269 + GElf_Shdr *glink;
    270 + glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
    271 + if (glink == NULL)
    272 + {
    273 + error (0, 0, gettext ("invalid sh_link value in section %Zu"),
    274 + elf_ndxscn (scn));
    275 + return;
    276 + }
    277 +
    278 printf (ngettext ("\
    279 \nDWARF section '%s' at offset %#" PRIx64 " contains %zu entry:\n",
    280 "\
    281 --- elfutils-0.128/src/strip.c.orig
    282 +++ elfutils-0.128/src/strip.c
    283 @@ -413,6 +413,7 @@ handle_elf (int fd, Elf *elf, const char
    284 Elf_Data debuglink_crc_data;
    285 bool any_symtab_changes = false;
    286 Elf_Data *shstrtab_data = NULL;
    287 + size_t shdridx = 0;
    288
    289 /* Create the full name of the file. */
    290 if (prefix != NULL)
    291 @@ -543,6 +544,11 @@ handle_elf (int fd, Elf *elf, const char
    292 goto fail_close;
    293 }
    294
    295 + if (shstrndx >= shnum)
    296 + goto illformed;
    297 +
    298 +#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
    299 +
    300 /* Storage for section information. We leave room for two more
    301 entries since we unconditionally create a section header string
    302 table. Maybe some weird tool created an ELF file without one.
    303 @@ -564,7 +570,7 @@ handle_elf (int fd, Elf *elf, const char
    304 {
    305 /* This should always be true (i.e., there should not be any
    306 holes in the numbering). */
    307 - assert (elf_ndxscn (scn) == cnt);
    308 + elf_assert (elf_ndxscn (scn) == cnt);
    309
    310 shdr_info[cnt].scn = scn;
    311
    312 @@ -577,6 +583,7 @@ handle_elf (int fd, Elf *elf, const char
    313 shdr_info[cnt].shdr.sh_name);
    314 if (shdr_info[cnt].name == NULL)
    315 {
    316 + illformed:
    317 error (0, 0, gettext ("illformed file '%s'"), fname);
    318 goto fail_close;
    319 }
    320 @@ -586,6 +593,8 @@ handle_elf (int fd, Elf *elf, const char
    321
    322 /* Remember the shdr.sh_link value. */
    323 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
    324 + if (shdr_info[cnt].old_sh_link >= shnum)
    325 + goto illformed;
    326
    327 /* Sections in files other than relocatable object files which
    328 are not loaded can be freely moved by us. In relocatable
    329 @@ -598,7 +607,7 @@ handle_elf (int fd, Elf *elf, const char
    330 appropriate reference. */
    331 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
    332 {
    333 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    334 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
    335 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
    336 }
    337 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
    338 @@ -615,7 +624,12 @@ handle_elf (int fd, Elf *elf, const char
    339 for (inner = 1;
    340 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
    341 ++inner)
    342 + {
    343 + if (grpref[inner] < shnum)
    344 shdr_info[grpref[inner]].group_idx = cnt;
    345 + else
    346 + goto illformed;
    347 + }
    348
    349 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
    350 /* If the section group contains only one element and this
    351 @@ -626,7 +640,7 @@ handle_elf (int fd, Elf *elf, const char
    352 }
    353 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
    354 {
    355 - assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    356 + elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
    357 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
    358 }
    359
    360 @@ -634,7 +648,7 @@ handle_elf (int fd, Elf *elf, const char
    361 discarded right away. */
    362 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
    363 {
    364 - assert (shdr_info[cnt].group_idx != 0);
    365 + elf_assert (shdr_info[cnt].group_idx != 0);
    366
    367 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
    368 {
    369 @@ -709,11 +723,15 @@ handle_elf (int fd, Elf *elf, const char
    370 {
    371 /* If a relocation section is marked as being removed make
    372 sure the section it is relocating is removed, too. */
    373 - if ((shdr_info[cnt].shdr.sh_type == SHT_REL
    374 + if (shdr_info[cnt].shdr.sh_type == SHT_REL
    375 || shdr_info[cnt].shdr.sh_type == SHT_RELA)
    376 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    377 + {
    378 + if (shdr_info[cnt].shdr.sh_info >= shnum)
    379 + goto illformed;
    380 + else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
    381 shdr_info[cnt].idx = 1;
    382 }
    383 + }
    384
    385 if (shdr_info[cnt].idx == 1)
    386 {
    387 @@ -738,7 +756,7 @@ handle_elf (int fd, Elf *elf, const char
    388 if (shdr_info[cnt].symtab_idx != 0
    389 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
    390 {
    391 - assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    392 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
    393
    394 shdr_info[shdr_info[cnt].symtab_idx].data
    395 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    396 @@ -778,6 +796,9 @@ handle_elf (int fd, Elf *elf, const char
    397 else if (scnidx == SHN_XINDEX)
    398 scnidx = xndx;
    399
    400 + if (scnidx >= shnum)
    401 + goto illformed;
    402 +
    403 if (shdr_info[scnidx].idx == 0)
    404 {
    405 /* Mark this section as used. */
    406 @@ -809,12 +830,16 @@ handle_elf (int fd, Elf *elf, const char
    407 }
    408
    409 /* Handle references through sh_info. */
    410 - if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
    411 - && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    412 + if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
    413 + {
    414 + if (shdr_info[cnt].shdr.sh_info >= shnum)
    415 + goto illformed;
    416 + else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
    417 {
    418 shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
    419 changes |= shdr_info[cnt].shdr.sh_info < cnt;
    420 }
    421 + }
    422
    423 /* Mark the section as investigated. */
    424 shdr_info[cnt].idx = 2;
    425 @@ -953,7 +978,7 @@ handle_elf (int fd, Elf *elf, const char
    426 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
    427 elf_errmsg (-1));
    428
    429 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    430 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    431
    432 /* Add this name to the section header string table. */
    433 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
    434 @@ -990,7 +1015,7 @@ handle_elf (int fd, Elf *elf, const char
    435 error (EXIT_FAILURE, 0,
    436 gettext ("while create section header section: %s"),
    437 elf_errmsg (-1));
    438 - assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    439 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
    440
    441 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
    442 if (shdr_info[cnt].data == NULL)
    443 @@ -1021,7 +1046,7 @@ handle_elf (int fd, Elf *elf, const char
    444 }
    445
    446 /* Index of the section header table in the shdr_info array. */
    447 - size_t shdridx = cnt;
    448 + shdridx = cnt;
    449
    450 /* Add the section header string table section name. */
    451 shdr_info[cnt].se = ebl_strtabadd (shst, ".shstrtab", 10);
    452 @@ -1046,7 +1071,7 @@ handle_elf (int fd, Elf *elf, const char
    453 error (EXIT_FAILURE, 0,
    454 gettext ("while create section header section: %s"),
    455 elf_errmsg (-1));
    456 - assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    457 + elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
    458
    459 /* Finalize the string table and fill in the correct indices in the
    460 section headers. */
    461 @@ -1136,20 +1161,20 @@ handle_elf (int fd, Elf *elf, const char
    462 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
    463 NULL);
    464
    465 - assert ((versiondata->d_size / sizeof (Elf32_Word))
    466 + elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
    467 >= shdr_info[cnt].data->d_size / elsize);
    468 }
    469
    470 if (shdr_info[cnt].version_idx != 0)
    471 {
    472 - assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    473 + elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
    474 /* This section has associated version
    475 information. We have to modify that
    476 information, too. */
    477 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
    478 NULL);
    479
    480 - assert ((versiondata->d_size / sizeof (GElf_Versym))
    481 + elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
    482 >= shdr_info[cnt].data->d_size / elsize);
    483 }
    484
    485 @@ -1204,7 +1229,7 @@ handle_elf (int fd, Elf *elf, const char
    486 sec = shdr_info[sym->st_shndx].idx;
    487 else
    488 {
    489 - assert (shndxdata != NULL);
    490 + elf_assert (shndxdata != NULL);
    491
    492 sec = shdr_info[xshndx].idx;
    493 }
    494 @@ -1225,7 +1250,7 @@ handle_elf (int fd, Elf *elf, const char
    495 nxshndx = sec;
    496 }
    497
    498 - assert (sec < SHN_LORESERVE || shndxdata != NULL);
    499 + elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
    500
    501 if ((inner != destidx || nshndx != sym->st_shndx
    502 || (shndxdata != NULL && nxshndx != xshndx))
    503 @@ -1248,7 +1273,7 @@ handle_elf (int fd, Elf *elf, const char
    504 else
    505 /* This is a section symbol for a section which has
    506 been removed. */
    507 - assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    508 + elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
    509 }
    510
    511 if (destidx != inner)
    512 @@ -1441,11 +1466,11 @@ handle_elf (int fd, Elf *elf, const char
    513 {
    514 GElf_Sym sym_mem;
    515 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    516 - assert (sym != NULL);
    517 + elf_assert (sym != NULL);
    518
    519 const char *name = elf_strptr (elf, strshndx,
    520 sym->st_name);
    521 - assert (name != NULL);
    522 + elf_assert (name != NULL);
    523 size_t hidx = elf_hash (name) % nbucket;
    524
    525 if (bucket[hidx] == 0)
    526 @@ -1464,7 +1489,7 @@ handle_elf (int fd, Elf *elf, const char
    527 else
    528 {
    529 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
    530 - assert (shdr_info[cnt].shdr.sh_entsize
    531 + elf_assert (shdr_info[cnt].shdr.sh_entsize
    532 == sizeof (Elf64_Xword));
    533
    534 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
    535 @@ -1495,11 +1520,11 @@ handle_elf (int fd, Elf *elf, const char
    536 {
    537 GElf_Sym sym_mem;
    538 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
    539 - assert (sym != NULL);
    540 + elf_assert (sym != NULL);
    541
    542 const char *name = elf_strptr (elf, strshndx,
    543 sym->st_name);
    544 - assert (name != NULL);
    545 + elf_assert (name != NULL);
    546 size_t hidx = elf_hash (name) % nbucket;
    547
    548 if (bucket[hidx] == 0)
    549 --- elfutils-0.130/src/elflint.c.robustify
    550 +++ elfutils-0.130/src/elflint.c
    551 @@ -126,6 +126,9 @@ static uint32_t shstrndx;
    552 /* Array to count references in section groups. */
    553 static int *scnref;
    554
    555 +/* Number of sections. */
    556 +static unsigned int shnum;
    557 +
    558
    559 int
    560 main (int argc, char *argv[])
    561 @@ -315,10 +318,19 @@ section_name (Ebl *ebl, int idx)
    562 {
    563 GElf_Shdr shdr_mem;
    564 GElf_Shdr *shdr;
    565 + const char *ret;
    566 +
    567 + if ((unsigned int) idx > shnum)
    568 + return "<invalid>";
    569
    570 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
    571 + if (shdr == NULL)
    572 + return "<invalid>";
    573
    574 - return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    575 + ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
    576 + if (ret == NULL)
    577 + return "<invalid>";
    578 + return ret;
    579 }
    580
    581
    582 @@ -340,10 +352,6 @@ static const int valid_e_machine[] =
    583 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
    584
    585
    586 -/* Number of sections. */
    587 -static unsigned int shnum;
    588 -
    589 -
    590 static void
    591 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
    592 {
    593 @@ -606,7 +614,8 @@ section [%2d] '%s': symbol table cannot
    594 }
    595 }
    596
    597 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
    598 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
    599 + if (shdr->sh_entsize != sh_entsize)
    600 ERROR (gettext ("\
    601 section [%2zu] '%s': entry size is does not match ElfXX_Sym\n"),
    602 cnt, section_name (ebl, cnt));
    603 @@ -644,7 +653,7 @@ section [%2d] '%s': XINDEX for zeroth en
    604 xndxscnidx, section_name (ebl, xndxscnidx));
    605 }
    606
    607 - for (cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    608 + for (cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
    609 {
    610 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
    611 if (sym == NULL)
    612 @@ -662,7 +671,8 @@ section [%2d] '%s': symbol %zu: invalid
    613 else
    614 {
    615 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
    616 - assert (name != NULL);
    617 + assert (name != NULL
    618 + || strshdr->sh_type != SHT_STRTAB);
    619 }
    620
    621 if (sym->st_shndx == SHN_XINDEX)
    622 @@ -992,9 +1002,11 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e
    623 {
    624 GElf_Shdr rcshdr_mem;
    625 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
    626 - assert (rcshdr != NULL);
    627
    628 - if (rcshdr->sh_type == SHT_DYNAMIC)
    629 + if (rcshdr == NULL)
    630 + break;
    631 +
    632 + if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
    633 {
    634 /* Found the dynamic section. Look through it. */
    635 Elf_Data *d = elf_getdata (scn, NULL);
    636 @@ -1004,7 +1016,9 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e
    637 {
    638 GElf_Dyn dyn_mem;
    639 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
    640 - assert (dyn != NULL);
    641 +
    642 + if (dyn == NULL)
    643 + break;
    644
    645 if (dyn->d_tag == DT_RELCOUNT)
    646 {
    647 @@ -1018,7 +1032,9 @@ section [%2d] '%s': DT_RELCOUNT used for
    648 /* Does the number specified number of relative
    649 relocations exceed the total number of
    650 relocations? */
    651 - if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
    652 + if (shdr->sh_entsize != 0
    653 + && dyn->d_un.d_val > (shdr->sh_size
    654 + / shdr->sh_entsize))
    655 ERROR (gettext ("\
    656 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
    657 idx, section_name (ebl, idx),
    658 @@ -1178,7 +1194,8 @@ section [%2d] '%s': no relocations for m
    659 }
    660 }
    661
    662 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT))
    663 + size_t sh_entsize = gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT);
    664 + if (shdr->sh_entsize != sh_entsize)
    665 ERROR (gettext (reltype == ELF_T_RELA ? "\
    666 section [%2d] '%s': section entry size does not match ElfXX_Rela\n" : "\
    667 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
    668 @@ -1401,7 +1418,8 @@ check_rela (Ebl *ebl, GElf_Ehdr *ehdr, G
    669 Elf_Data *symdata = elf_getdata (symscn, NULL);
    670 enum load_state state = state_undecided;
    671
    672 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    673 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
    674 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    675 {
    676 GElf_Rela rela_mem;
    677 GElf_Rela *rela = gelf_getrela (data, cnt, &rela_mem);
    678 @@ -1451,7 +1469,8 @@ check_rel (Ebl *ebl, GElf_Ehdr *ehdr, GE
    679 Elf_Data *symdata = elf_getdata (symscn, NULL);
    680 enum load_state state = state_undecided;
    681
    682 - for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    683 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
    684 + for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    685 {
    686 GElf_Rel rel_mem;
    687 GElf_Rel *rel = gelf_getrel (data, cnt, &rel_mem);
    688 @@ -1555,7 +1574,8 @@ section [%2d] '%s': referenced as string
    689 shdr->sh_link, section_name (ebl, shdr->sh_link),
    690 idx, section_name (ebl, idx));
    691
    692 - if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
    693 + size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
    694 + if (shdr->sh_entsize != sh_entsize)
    695 ERROR (gettext ("\
    696 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
    697 idx, section_name (ebl, idx));
    698 @@ -1565,7 +1585,7 @@ section [%2d] '%s': section entry size d
    699 idx, section_name (ebl, idx));
    700
    701 bool non_null_warned = false;
    702 - for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
    703 + for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
    704 {
    705 GElf_Dyn dyn_mem;
    706 GElf_Dyn *dyn = gelf_getdyn (data, cnt, &dyn_mem);
    707 @@ -1846,6 +1866,8 @@ section [%2d] '%s': entry size does not
    708 idx, section_name (ebl, idx));
    709
    710 if (symshdr != NULL
    711 + && shdr->sh_entsize
    712 + && symshdr->sh_entsize
    713 && (shdr->sh_size / shdr->sh_entsize
    714 < symshdr->sh_size / symshdr->sh_entsize))
    715 ERROR (gettext ("\
    716 @@ -1872,6 +1894,12 @@ section [%2d] '%s': extended section ind
    717 }
    718
    719 Elf_Data *data = elf_getdata (elf_getscn (ebl->elf, idx), NULL);
    720 + if (data == NULL)
    721 + {
    722 + ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
    723 + idx, section_name (ebl, idx));
    724 + return;
    725 + }
    726
    727 if (*((Elf32_Word *) data->d_buf) != 0)
    728 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
    729 @@ -1914,7 +1942,7 @@ section [%2d] '%s': hash table section i
    730
    731 size_t maxidx = nchain;
    732
    733 - if (symshdr != NULL)
    734 + if (symshdr != NULL && symshdr->sh_entsize != 0)
    735 {
    736 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
    737
    738 @@ -1925,18 +1953,28 @@ section [%2d] '%s': hash table section i
    739 maxidx = symsize;
    740 }
    741
    742 + Elf32_Word *buf = (Elf32_Word *) data->d_buf;
    743 + Elf32_Word *end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
    744 size_t cnt;
    745 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
    746 - if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
    747 + {
    748 + if (buf + cnt >= end)
    749 + break;
    750 + else if (buf[cnt] >= maxidx)
    751 ERROR (gettext ("\
    752 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
    753 idx, section_name (ebl, idx), cnt - 2);
    754 + }
    755
    756 for (; cnt < 2 + nbucket + nchain; ++cnt)
    757 - if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
    758 + {
    759 + if (buf + cnt >= end)
    760 + break;
    761 + else if (buf[cnt] >= maxidx)
    762 ERROR (gettext ("\
    763 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
    764 idx, section_name (ebl, idx), cnt - 2 - nbucket);
    765 + }
    766 }
    767
    768
    769 @@ -1966,18 +2004,28 @@ section [%2d] '%s': hash table section i
    770 maxidx = symsize;
    771 }
    772
    773 + Elf64_Xword *buf = (Elf64_Xword *) data->d_buf;
    774 + Elf64_Xword *end = (Elf64_Xword *) ((char *) data->d_buf + shdr->sh_size);
    775 size_t cnt;
    776 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
    777 - if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
    778 + {
    779 + if (buf + cnt >= end)
    780 + break;
    781 + else if (buf[cnt] >= maxidx)
    782 ERROR (gettext ("\
    783 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
    784 idx, section_name (ebl, idx), cnt - 2);
    785 + }
    786
    787 for (; cnt < 2 + nbucket + nchain; ++cnt)
    788 - if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
    789 + {
    790 + if (buf + cnt >= end)
    791 + break;
    792 + else if (buf[cnt] >= maxidx)
    793 ERROR (gettext ("\
    794 section [%2d] '%s': hash chain reference %" PRIu64 " out of bounds\n"),
    795 - idx, section_name (ebl, idx), (uint64_t) (cnt - 2 - nbucket));
    796 + idx, section_name (ebl, idx), (uint64_t) cnt - 2 - nbucket);
    797 + }
    798 }
    799
    800
    801 @@ -2002,7 +2050,7 @@ section [%2d] '%s': bitmask size not pow
    802 if (shdr->sh_size < (4 + bitmask_words + nbuckets) * sizeof (Elf32_Word))
    803 {
    804 ERROR (gettext ("\
    805 -section [%2d] '%s': hash table section is too small (is %ld, expected at least%ld)\n"),
    806 +section [%2d] '%s': hash table section is too small (is %ld, expected at least %ld)\n"),
    807 idx, section_name (ebl, idx), (long int) shdr->sh_size,
    808 (long int) ((4 + bitmask_words + nbuckets) * sizeof (Elf32_Word)));
    809 return;
    810 @@ -2659,8 +2707,9 @@ section [%2d] '%s' refers in sh_link to
    811
    812 /* The number of elements in the version symbol table must be the
    813 same as the number of symbols. */
    814 - if (shdr->sh_size / shdr->sh_entsize
    815 - != symshdr->sh_size / symshdr->sh_entsize)
    816 + if (shdr->sh_entsize && symshdr->sh_entsize
    817 + && (shdr->sh_size / shdr->sh_entsize
    818 + != symshdr->sh_size / symshdr->sh_entsize))
    819 ERROR (gettext ("\
    820 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
    821 idx, section_name (ebl, idx),
    822 --- elfutils-0.127/libelf/elf_begin.c.robustify
    823 +++ elfutils-0.127/libelf/elf_begin.c
    824 @@ -155,7 +155,8 @@ get_shnum (void *map_address, unsigned c
    825
    826 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
    827 {
    828 - if (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
    829 + if (unlikely (ehdr.e32->e_shoff >= maxsize)
    830 + || unlikely (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize))
    831 /* Cannot read the first section header. */
    832 return 0;
    833
    834 @@ -203,7 +204,8 @@ get_shnum (void *map_address, unsigned c
    835
    836 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
    837 {
    838 - if (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
    839 + if (unlikely (ehdr.e64->e_shoff >= maxsize)
    840 + || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
    841 /* Cannot read the first section header. */
    842 return 0;
    843
    844 @@ -275,6 +277,15 @@ file_read_elf (int fildes, void *map_add
    845 /* Could not determine the number of sections. */
    846 return NULL;
    847
    848 + /* Check for too many sections. */
    849 + if (e_ident[EI_CLASS] == ELFCLASS32)
    850 + {
    851 + if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
    852 + return NULL;
    853 + }
    854 + else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
    855 + return NULL;
    856 +
    857 /* We can now allocate the memory. */
    858 Elf *elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
    859 ELF_K_ELF, scncnt * sizeof (Elf_Scn));
    860 @@ -308,13 +319,31 @@ file_read_elf (int fildes, void *map_add
    861 {
    862 /* We can use the mmapped memory. */
    863 elf->state.elf32.ehdr = ehdr;
    864 +
    865 + if (unlikely (ehdr->e_shoff >= maxsize)
    866 + || unlikely (ehdr->e_shoff
    867 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
    868 + {
    869 + free_and_out:
    870 + free (elf);
    871 + __libelf_seterrno (ELF_E_INVALID_FILE);
    872 + return NULL;
    873 + }
    874 elf->state.elf32.shdr
    875 = (Elf32_Shdr *) ((char *) ehdr + ehdr->e_shoff);
    876 +
    877 if (ehdr->e_phnum > 0)
    878 + {
    879 /* Assign a value only if there really is a program
    880 header. Otherwise the value remains NULL. */
    881 + if (unlikely (ehdr->e_phoff >= maxsize)
    882 + || unlikely (ehdr->e_phoff
    883 + + ehdr->e_phnum
    884 + * sizeof (Elf32_Phdr) > maxsize))
    885 + goto free_and_out;
    886 elf->state.elf32.phdr
    887 = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff);
    888 + }
    889
    890 for (size_t cnt = 0; cnt < scncnt; ++cnt)
    891 {
    892 @@ -383,13 +412,26 @@ file_read_elf (int fildes, void *map_add
    893 {
    894 /* We can use the mmapped memory. */
    895 elf->state.elf64.ehdr = ehdr;
    896 +
    897 + if (unlikely (ehdr->e_shoff >= maxsize)
    898 + || unlikely (ehdr->e_shoff
    899 + + scncnt * sizeof (Elf32_Shdr) > maxsize))
    900 + goto free_and_out;
    901 elf->state.elf64.shdr
    902 = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff);
    903 +
    904 if (ehdr->e_phnum > 0)
    905 + {
    906 /* Assign a value only if there really is a program
    907 header. Otherwise the value remains NULL. */
    908 + if (unlikely (ehdr->e_phoff >= maxsize)
    909 + || unlikely (ehdr->e_phoff
    910 + + ehdr->e_phnum
    911 + * sizeof (Elf32_Phdr) > maxsize))
    912 + goto free_and_out;
    913 elf->state.elf64.phdr
    914 = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff);
    915 + }
    916
    917 for (size_t cnt = 0; cnt < scncnt; ++cnt)
    918 {
    919 --- elfutils-0.127/libelf/libelfP.h.robustify
    920 +++ elfutils-0.127/libelf/libelfP.h
    921 @@ -574,4 +574,13 @@ extern uint32_t __libelf_crc32 (uint32_t
    922 } \
    923 } while (0)
    924
    925 +/* Convenience macro. Assumes int NDX and TYPE with size at least
    926 + 2 bytes. */
    927 +#if SIZE_MAX > 4294967295U
    928 +# define INVALID_NDX(ndx, type) unlikely (ndx < 0)
    929 +#else
    930 +# define INVALID_NDX(ndx, type) \
    931 + unlikely ((unsigned int) (ndx) >= SIZE_MAX / sizeof (type))
    932 +#endif
    933 +
    934 #endif /* libelfP.h */
    935 --- elfutils-0.127/libelf/gelf_update_move.c.robustify
    936 +++ elfutils-0.127/libelf/gelf_update_move.c
    937 @@ -75,7 +75,7 @@ gelf_update_move (data, ndx, src)
    938 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
    939
    940 /* Check whether we have to resize the data buffer. */
    941 - if (unlikely (ndx < 0)
    942 + if (INVALID_NDX (ndx, GElf_Move)
    943 || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
    944 {
    945 __libelf_seterrno (ELF_E_INVALID_INDEX);
    946 --- elfutils-0.127/libelf/gelf_getsym.c.robustify
    947 +++ elfutils-0.127/libelf/gelf_getsym.c
    948 @@ -90,7 +90,8 @@ gelf_getsym (data, ndx, dst)
    949 table entries has to be adopted. The user better has provided
    950 a buffer where we can store the information. While copying the
    951 data we are converting the format. */
    952 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    953 + if (INVALID_NDX (ndx, Elf32_Sym)
    954 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
    955 {
    956 __libelf_seterrno (ELF_E_INVALID_INDEX);
    957 goto out;
    958 @@ -119,7 +120,8 @@ gelf_getsym (data, ndx, dst)
    959
    960 /* The data is already in the correct form. Just make sure the
    961 index is OK. */
    962 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    963 + if (INVALID_NDX (ndx, GElf_Sym)
    964 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
    965 {
    966 __libelf_seterrno (ELF_E_INVALID_INDEX);
    967 goto out;
    968 --- elfutils-0.127/libelf/gelf_getrela.c.robustify
    969 +++ elfutils-0.127/libelf/gelf_getrela.c
    970 @@ -71,12 +71,6 @@ gelf_getrela (data, ndx, dst)
    971 if (data_scn == NULL)
    972 return NULL;
    973
    974 - if (unlikely (ndx < 0))
    975 - {
    976 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    977 - return NULL;
    978 - }
    979 -
    980 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    981 {
    982 __libelf_seterrno (ELF_E_INVALID_HANDLE);
    983 @@ -93,7 +87,8 @@ gelf_getrela (data, ndx, dst)
    984 if (scn->elf->class == ELFCLASS32)
    985 {
    986 /* We have to convert the data. */
    987 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    988 + if (INVALID_NDX (ndx, Elf32_Rela)
    989 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    990 {
    991 __libelf_seterrno (ELF_E_INVALID_INDEX);
    992 result = NULL;
    993 @@ -114,7 +109,8 @@ gelf_getrela (data, ndx, dst)
    994 {
    995 /* Simply copy the data after we made sure we are actually getting
    996 correct data. */
    997 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    998 + if (INVALID_NDX (ndx, Elf64_Rela)
    999 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    1000 {
    1001 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1002 result = NULL;
    1003 --- elfutils-0.127/libelf/gelf_getmove.c.robustify
    1004 +++ elfutils-0.127/libelf/gelf_getmove.c
    1005 @@ -83,7 +83,8 @@ gelf_getmove (data, ndx, dst)
    1006
    1007 /* The data is already in the correct form. Just make sure the
    1008 index is OK. */
    1009 - if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    1010 + if (INVALID_NDX (ndx, GElf_Move)
    1011 + || unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
    1012 {
    1013 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1014 goto out;
    1015 --- elfutils-0.127/libelf/gelf_update_symshndx.c.robustify
    1016 +++ elfutils-0.127/libelf/gelf_update_symshndx.c
    1017 @@ -77,12 +77,6 @@ gelf_update_symshndx (symdata, shndxdata
    1018 if (symdata == NULL)
    1019 return 0;
    1020
    1021 - if (unlikely (ndx < 0))
    1022 - {
    1023 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1024 - return 0;
    1025 - }
    1026 -
    1027 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
    1028 {
    1029 /* The type of the data better should match. */
    1030 @@ -128,7 +122,8 @@ gelf_update_symshndx (symdata, shndxdata
    1031 }
    1032
    1033 /* Check whether we have to resize the data buffer. */
    1034 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    1035 + if (INVALID_NDX (ndx, Elf32_Sym)
    1036 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
    1037 {
    1038 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1039 goto out;
    1040 @@ -151,7 +146,8 @@ gelf_update_symshndx (symdata, shndxdata
    1041 else
    1042 {
    1043 /* Check whether we have to resize the data buffer. */
    1044 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    1045 + if (INVALID_NDX (ndx, Elf64_Sym)
    1046 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
    1047 {
    1048 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1049 goto out;
    1050 --- elfutils-0.127/libelf/gelf_update_dyn.c.robustify
    1051 +++ elfutils-0.127/libelf/gelf_update_dyn.c
    1052 @@ -71,12 +71,6 @@ gelf_update_dyn (data, ndx, src)
    1053 if (data == NULL)
    1054 return 0;
    1055
    1056 - if (unlikely (ndx < 0))
    1057 - {
    1058 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1059 - return 0;
    1060 - }
    1061 -
    1062 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
    1063 {
    1064 /* The type of the data better should match. */
    1065 @@ -102,7 +96,8 @@ gelf_update_dyn (data, ndx, src)
    1066 }
    1067
    1068 /* Check whether we have to resize the data buffer. */
    1069 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    1070 + if (INVALID_NDX (ndx, Elf32_Dyn)
    1071 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    1072 {
    1073 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1074 goto out;
    1075 @@ -116,7 +111,8 @@ gelf_update_dyn (data, ndx, src)
    1076 else
    1077 {
    1078 /* Check whether we have to resize the data buffer. */
    1079 - if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    1080 + if (INVALID_NDX (ndx, Elf64_Dyn)
    1081 + || unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
    1082 {
    1083 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1084 goto out;
    1085 --- elfutils-0.127/libelf/gelf_update_rela.c.robustify
    1086 +++ elfutils-0.127/libelf/gelf_update_rela.c
    1087 @@ -68,12 +68,6 @@ gelf_update_rela (Elf_Data *dst, int ndx
    1088 if (dst == NULL)
    1089 return 0;
    1090
    1091 - if (unlikely (ndx < 0))
    1092 - {
    1093 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1094 - return 0;
    1095 - }
    1096 -
    1097 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
    1098 {
    1099 /* The type of the data better should match. */
    1100 @@ -101,7 +95,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    1101 }
    1102
    1103 /* Check whether we have to resize the data buffer. */
    1104 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    1105 + if (INVALID_NDX (ndx, Elf32_Rela)
    1106 + || unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
    1107 {
    1108 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1109 goto out;
    1110 @@ -117,7 +112,8 @@ gelf_update_rela (Elf_Data *dst, int ndx
    1111 else
    1112 {
    1113 /* Check whether we have to resize the data buffer. */
    1114 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    1115 + if (INVALID_NDX (ndx, Elf64_Rela)
    1116 + || unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
    1117 {
    1118 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1119 goto out;
    1120 --- elfutils-0.127/libelf/gelf_getsymshndx.c.robustify
    1121 +++ elfutils-0.127/libelf/gelf_getsymshndx.c
    1122 @@ -90,7 +90,9 @@ gelf_getsymshndx (symdata, shndxdata, nd
    1123 section index table. */
    1124 if (likely (shndxdata_scn != NULL))
    1125 {
    1126 - if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
    1127 + if (INVALID_NDX (ndx, Elf32_Word)
    1128 + || unlikely ((ndx + 1) * sizeof (Elf32_Word)
    1129 + > shndxdata_scn->d.d_size))
    1130 {
    1131 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1132 goto out;
    1133 @@ -110,7 +112,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    1134 table entries has to be adopted. The user better has provided
    1135 a buffer where we can store the information. While copying the
    1136 data we are converting the format. */
    1137 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    1138 + if (INVALID_NDX (ndx, Elf32_Sym)
    1139 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
    1140 {
    1141 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1142 goto out;
    1143 @@ -139,7 +142,8 @@ gelf_getsymshndx (symdata, shndxdata, nd
    1144
    1145 /* The data is already in the correct form. Just make sure the
    1146 index is OK. */
    1147 - if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    1148 + if (INVALID_NDX (ndx, GElf_Sym)
    1149 + || unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
    1150 {
    1151 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1152 goto out;
    1153 --- elfutils-0.127/libelf/elf32_newphdr.c.robustify
    1154 +++ elfutils-0.127/libelf/elf32_newphdr.c
    1155 @@ -124,6 +124,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count)
    1156 else if (elf->state.ELFW(elf,LIBELFBITS).ehdr->e_phnum != count
    1157 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
    1158 {
    1159 + if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
    1160 + {
    1161 + result = NULL;
    1162 + goto out;
    1163 + }
    1164 +
    1165 /* Allocate a new program header with the appropriate number of
    1166 elements. */
    1167 result = (ElfW2(LIBELFBITS,Phdr) *)
    1168 --- elfutils-0.127/libelf/gelf_update_sym.c.robustify
    1169 +++ elfutils-0.127/libelf/gelf_update_sym.c
    1170 @@ -72,12 +72,6 @@ gelf_update_sym (data, ndx, src)
    1171 if (data == NULL)
    1172 return 0;
    1173
    1174 - if (unlikely (ndx < 0))
    1175 - {
    1176 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1177 - return 0;
    1178 - }
    1179 -
    1180 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
    1181 {
    1182 /* The type of the data better should match. */
    1183 @@ -102,7 +96,8 @@ gelf_update_sym (data, ndx, src)
    1184 }
    1185
    1186 /* Check whether we have to resize the data buffer. */
    1187 - if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    1188 + if (INVALID_NDX (ndx, Elf32_Sym)
    1189 + || unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
    1190 {
    1191 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1192 goto out;
    1193 @@ -125,7 +120,8 @@ gelf_update_sym (data, ndx, src)
    1194 else
    1195 {
    1196 /* Check whether we have to resize the data buffer. */
    1197 - if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    1198 + if (INVALID_NDX (ndx, Elf64_Sym)
    1199 + || unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
    1200 {
    1201 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1202 goto out;
    1203 --- elfutils-0.127/libelf/gelf_getsyminfo.c.robustify
    1204 +++ elfutils-0.127/libelf/gelf_getsyminfo.c
    1205 @@ -84,7 +84,8 @@ gelf_getsyminfo (data, ndx, dst)
    1206
    1207 /* The data is already in the correct form. Just make sure the
    1208 index is OK. */
    1209 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    1210 + if (INVALID_NDX (ndx, GElf_Syminfo)
    1211 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
    1212 {
    1213 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1214 goto out;
    1215 --- elfutils-0.127/libelf/gelf_getlib.c.robustify
    1216 +++ elfutils-0.127/libelf/gelf_getlib.c
    1217 @@ -86,7 +86,8 @@ gelf_getlib (data, ndx, dst)
    1218 /* The data is already in the correct form. Just make sure the
    1219 index is OK. */
    1220 GElf_Lib *result = NULL;
    1221 - if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    1222 + if (INVALID_NDX (ndx, GElf_Lib)
    1223 + || unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
    1224 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1225 else
    1226 {
    1227 --- elfutils-0.127/libelf/elf32_updatefile.c.robustify
    1228 +++ elfutils-0.127/libelf/elf32_updatefile.c
    1229 @@ -201,6 +201,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf
    1230 /* Write all the sections. Well, only those which are modified. */
    1231 if (shnum > 0)
    1232 {
    1233 + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
    1234 + return 1;
    1235 +
    1236 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
    1237 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
    1238 char *const shdr_start = ((char *) elf->map_address + elf->start_offset
    1239 @@ -571,6 +574,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf
    1240 /* Write all the sections. Well, only those which are modified. */
    1241 if (shnum > 0)
    1242 {
    1243 + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
    1244 + + sizeof (ElfW2(LIBELFBITS,Shdr)))))
    1245 + return 1;
    1246 +
    1247 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
    1248 #if EV_NUM != 2
    1249 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
    1250 --- elfutils-0.127/libelf/gelf_getversym.c.robustify
    1251 +++ elfutils-0.127/libelf/gelf_getversym.c
    1252 @@ -92,7 +92,8 @@ gelf_getversym (data, ndx, dst)
    1253
    1254 /* The data is already in the correct form. Just make sure the
    1255 index is OK. */
    1256 - if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    1257 + if (INVALID_NDX (ndx, GElf_Versym)
    1258 + || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
    1259 {
    1260 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1261 result = NULL;
    1262 --- elfutils-0.127/libelf/elf_getarsym.c.robustify
    1263 +++ elfutils-0.127/libelf/elf_getarsym.c
    1264 @@ -179,6 +179,9 @@ elf_getarsym (elf, ptr)
    1265 size_t index_size = atol (tmpbuf);
    1266
    1267 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
    1268 +#if SIZE_MAX <= 4294967295U
    1269 + || n >= SIZE_MAX / sizeof (Elf_Arsym)
    1270 +#endif
    1271 || n * sizeof (uint32_t) > index_size)
    1272 {
    1273 /* This index table cannot be right since it does not fit into
    1274 --- elfutils-0.127/libelf/gelf_getrel.c.robustify
    1275 +++ elfutils-0.127/libelf/gelf_getrel.c
    1276 @@ -71,12 +71,6 @@ gelf_getrel (data, ndx, dst)
    1277 if (data_scn == NULL)
    1278 return NULL;
    1279
    1280 - if (unlikely (ndx < 0))
    1281 - {
    1282 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1283 - return NULL;
    1284 - }
    1285 -
    1286 if (unlikely (data_scn->d.d_type != ELF_T_REL))
    1287 {
    1288 __libelf_seterrno (ELF_E_INVALID_HANDLE);
    1289 @@ -93,7 +87,8 @@ gelf_getrel (data, ndx, dst)
    1290 if (scn->elf->class == ELFCLASS32)
    1291 {
    1292 /* We have to convert the data. */
    1293 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    1294 + if (INVALID_NDX (ndx, Elf32_Rel)
    1295 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    1296 {
    1297 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1298 result = NULL;
    1299 @@ -113,7 +108,8 @@ gelf_getrel (data, ndx, dst)
    1300 {
    1301 /* Simply copy the data after we made sure we are actually getting
    1302 correct data. */
    1303 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    1304 + if (INVALID_NDX (ndx, Elf64_Rel)
    1305 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    1306 {
    1307 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1308 result = NULL;
    1309 --- elfutils-0.127/libelf/gelf_update_versym.c.robustify
    1310 +++ elfutils-0.127/libelf/gelf_update_versym.c
    1311 @@ -75,7 +75,7 @@ gelf_update_versym (data, ndx, src)
    1312 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
    1313
    1314 /* Check whether we have to resize the data buffer. */
    1315 - if (unlikely (ndx < 0)
    1316 + if (INVALID_NDX (ndx, GElf_Versym)
    1317 || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
    1318 {
    1319 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1320 --- elfutils-0.127/libelf/gelf_getdyn.c.robustify
    1321 +++ elfutils-0.127/libelf/gelf_getdyn.c
    1322 @@ -93,7 +93,8 @@ gelf_getdyn (data, ndx, dst)
    1323 table entries has to be adopted. The user better has provided
    1324 a buffer where we can store the information. While copying the
    1325 data we are converting the format. */
    1326 - if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    1327 + if (INVALID_NDX (ndx, Elf32_Dyn)
    1328 + || unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
    1329 {
    1330 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1331 goto out;
    1332 @@ -114,7 +115,8 @@ gelf_getdyn (data, ndx, dst)
    1333
    1334 /* The data is already in the correct form. Just make sure the
    1335 index is OK. */
    1336 - if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    1337 + if (INVALID_NDX (ndx, GElf_Dyn)
    1338 + || unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
    1339 {
    1340 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1341 goto out;
    1342 --- elfutils-0.127/libelf/gelf_update_syminfo.c.robustify
    1343 +++ elfutils-0.127/libelf/gelf_update_syminfo.c
    1344 @@ -72,12 +72,6 @@ gelf_update_syminfo (data, ndx, src)
    1345 if (data == NULL)
    1346 return 0;
    1347
    1348 - if (unlikely (ndx < 0))
    1349 - {
    1350 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1351 - return 0;
    1352 - }
    1353 -
    1354 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
    1355 {
    1356 /* The type of the data better should match. */
    1357 @@ -93,7 +87,8 @@ gelf_update_syminfo (data, ndx, src)
    1358 rwlock_wrlock (scn->elf->lock);
    1359
    1360 /* Check whether we have to resize the data buffer. */
    1361 - if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    1362 + if (INVALID_NDX (ndx, GElf_Syminfo)
    1363 + || unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
    1364 {
    1365 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1366 goto out;
    1367 --- elfutils-0.127/libelf/gelf_update_rel.c.robustify
    1368 +++ elfutils-0.127/libelf/gelf_update_rel.c
    1369 @@ -68,12 +68,6 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    1370 if (dst == NULL)
    1371 return 0;
    1372
    1373 - if (unlikely (ndx < 0))
    1374 - {
    1375 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1376 - return 0;
    1377 - }
    1378 -
    1379 if (unlikely (data_scn->d.d_type != ELF_T_REL))
    1380 {
    1381 /* The type of the data better should match. */
    1382 @@ -99,7 +93,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    1383 }
    1384
    1385 /* Check whether we have to resize the data buffer. */
    1386 - if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    1387 + if (INVALID_NDX (ndx, Elf32_Rel)
    1388 + || unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
    1389 {
    1390 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1391 goto out;
    1392 @@ -114,7 +109,8 @@ gelf_update_rel (Elf_Data *dst, int ndx,
    1393 else
    1394 {
    1395 /* Check whether we have to resize the data buffer. */
    1396 - if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    1397 + if (INVALID_NDX (ndx, Elf64_Rel)
    1398 + || unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
    1399 {
    1400 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1401 goto out;
    1402 --- elfutils-0.127/libelf/elf_newscn.c.robustify
    1403 +++ elfutils-0.127/libelf/elf_newscn.c
    1404 @@ -104,10 +104,18 @@ elf_newscn (elf)
    1405 else
    1406 {
    1407 /* We must allocate a new element. */
    1408 - Elf_ScnList *newp;
    1409 + Elf_ScnList *newp = NULL;
    1410
    1411 assert (elf->state.elf.scnincr > 0);
    1412
    1413 + if (
    1414 +#if SIZE_MAX <= 4294967295U
    1415 + likely (elf->state.elf.scnincr
    1416 + < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
    1417 +#else
    1418 + 1
    1419 +#endif
    1420 + )
    1421 newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
    1422 + ((elf->state.elf.scnincr *= 2)
    1423 * sizeof (Elf_Scn)), 1);
    1424 --- elfutils-0.127/libelf/gelf_update_lib.c.robustify
    1425 +++ elfutils-0.127/libelf/gelf_update_lib.c
    1426 @@ -68,12 +68,6 @@ gelf_update_lib (data, ndx, src)
    1427 if (data == NULL)
    1428 return 0;
    1429
    1430 - if (unlikely (ndx < 0))
    1431 - {
    1432 - __libelf_seterrno (ELF_E_INVALID_INDEX);
    1433 - return 0;
    1434 - }
    1435 -
    1436 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
    1437 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
    1438 {
    1439 @@ -87,7 +81,8 @@ gelf_update_lib (data, ndx, src)
    1440
    1441 /* Check whether we have to resize the data buffer. */
    1442 int result = 0;
    1443 - if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    1444 + if (INVALID_NDX (ndx, Elf64_Lib)
    1445 + || unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
    1446 __libelf_seterrno (ELF_E_INVALID_INDEX);
    1447 else
    1448 {
    1449 --- elfutils-0.127/libelf/elf_getshstrndx.c.robustify
    1450 +++ elfutils-0.127/libelf/elf_getshstrndx.c
    1451 @@ -125,10 +125,25 @@ elf_getshstrndx (elf, dst)
    1452 if (elf->map_address != NULL
    1453 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    1454 && (ALLOW_UNALIGNED
    1455 - || (((size_t) ((char *) elf->map_address + offset))
    1456 + || (((size_t) ((char *) elf->map_address
    1457 + + elf->start_offset + offset))
    1458 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
    1459 + {
    1460 + /* First see whether the information in the ELF header is
    1461 + valid and it does not ask for too much. */
    1462 + if (unlikely (offset + sizeof (Elf32_Shdr)
    1463 + > elf->maximum_size))
    1464 + {
    1465 + /* Something is wrong. */
    1466 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1467 + result = -1;
    1468 + goto out;
    1469 + }
    1470 +
    1471 /* We can directly access the memory. */
    1472 - num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
    1473 + num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
    1474 + + offset))->sh_link;
    1475 + }
    1476 else
    1477 {
    1478 /* We avoid reading in all the section headers. Just read
    1479 @@ -163,10 +178,25 @@ elf_getshstrndx (elf, dst)
    1480 if (elf->map_address != NULL
    1481 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
    1482 && (ALLOW_UNALIGNED
    1483 - || (((size_t) ((char *) elf->map_address + offset))
    1484 + || (((size_t) ((char *) elf->map_address
    1485 + + elf->start_offset + offset))
    1486 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
    1487 + {
    1488 + /* First see whether the information in the ELF header is
    1489 + valid and it does not ask for too much. */
    1490 + if (unlikely (offset + sizeof (Elf64_Shdr)
    1491 + > elf->maximum_size))
    1492 + {
    1493 + /* Something is wrong. */
    1494 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1495 + result = -1;
    1496 + goto out;
    1497 + }
    1498 +
    1499 /* We can directly access the memory. */
    1500 - num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
    1501 + num = ((Elf64_Shdr *) (elf->map_address
    1502 + + elf->start_offset + offset))->sh_link;
    1503 + }
    1504 else
    1505 {
    1506 /* We avoid reading in all the section headers. Just read
    1507 --- elfutils-0.127/libelf/elf32_getshdr.c.robustify
    1508 +++ elfutils-0.127/libelf/elf32_getshdr.c
    1509 @@ -101,7 +101,8 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1510 goto out;
    1511
    1512 size_t shnum;
    1513 - if (INTUSE (elf_getshnum) (elf, &shnum) != 0)
    1514 + if (INTUSE (elf_getshnum) (elf, &shnum) != 0
    1515 + || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
    1516 goto out;
    1517 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
    1518
    1519 @@ -118,6 +119,16 @@ elfw2(LIBELFBITS,getshdr) (scn)
    1520
    1521 if (elf->map_address != NULL)
    1522 {
    1523 + /* First see whether the information in the ELF header is
    1524 + valid and it does not ask for too much. */
    1525 + if (unlikely (ehdr->e_shoff >= elf->maximum_size)
    1526 + || unlikely (ehdr->e_shoff + size > elf->maximum_size))
    1527 + {
    1528 + /* Something is wrong. */
    1529 + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
    1530 + goto free_and_out;
    1531 + }
    1532 +
    1533 ElfW2(LIBELFBITS,Shdr) *notcvt;
    1534
    1535 /* All the data is already mapped. If we could use it
    1536 --- elfutils-0.127/libelf/elf32_getphdr.c.robustify
    1537 +++ elfutils-0.127/libelf/elf32_getphdr.c
    1538 @@ -116,6 +116,16 @@ elfw2(LIBELFBITS,getphdr) (elf)
    1539
    1540 if (elf->map_address != NULL)
    1541 {
    1542 + /* First see whether the information in the ELF header is
    1543 + valid and it does not ask for too much. */
    1544 + if (unlikely (ehdr->e_phoff >= elf->maximum_size)
    1545 + || unlikely (ehdr->e_phoff + size > elf->maximum_size))
    1546 + {
    1547 + /* Something is wrong. */
    1548 + __libelf_seterrno (ELF_E_INVALID_PHDR);
    1549 + goto out;
    1550 + }
    1551 +
    1552 /* All the data is already mapped. Use it. */
    1553 void *file_phdr = ((char *) elf->map_address
    1554 + elf->start_offset + ehdr->e_phoff);