|
| 1 | +From 9ae7d6bebe993a09b3b696ab5186d0d4ee470a8c Mon Sep 17 00:00:00 2001 |
| 2 | +From: "H.J. Lu" < [email protected]> |
| 3 | +Date: Thu, 18 Sep 2025 16:59:25 -0700 |
| 4 | +Subject: [PATCH] elf: Don't match corrupt section header in linker input |
| 5 | + |
| 6 | +Don't swap in nor match corrupt section header in linker input to avoid |
| 7 | +linker crash later. |
| 8 | + |
| 9 | + PR ld/33457 |
| 10 | + * elfcode.h (elf_swap_shdr_in): Changed to return bool. Return |
| 11 | + false for corrupt section header in linker input. |
| 12 | + (elf_object_p): Reject if elf_swap_shdr_in returns false. |
| 13 | + |
| 14 | +Signed-off-by: H.J. Lu < [email protected]> |
| 15 | +Signed-off-by: Azure Linux Security Servicing Account < [email protected]> |
| 16 | +Upstream-reference: AI Backport of https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=9ca499644a21ceb3f946d1c179c38a83be084490 |
| 17 | + |
| 18 | +--- |
| 19 | + bfd/elfcode.h | 16 ++++++++++------ |
| 20 | + 1 file changed, 10 insertions(+), 6 deletions(-) |
| 21 | + |
| 22 | +diff --git a/bfd/elfcode.h b/bfd/elfcode.h |
| 23 | +index 7eb27c2..0781745 100644 |
| 24 | +--- a/bfd/elfcode.h |
| 25 | ++++ b/bfd/elfcode.h |
| 26 | +@@ -298,7 +298,7 @@ elf_swap_ehdr_out (bfd *abfd, |
| 27 | + /* Translate an ELF section header table entry in external format into an |
| 28 | + ELF section header table entry in internal format. */ |
| 29 | + |
| 30 | +-static void |
| 31 | ++static bool |
| 32 | + elf_swap_shdr_in (bfd *abfd, |
| 33 | + const Elf_External_Shdr *src, |
| 34 | + Elf_Internal_Shdr *dst) |
| 35 | +@@ -325,9 +325,12 @@ elf_swap_shdr_in (bfd *abfd, |
| 36 | + && ((ufile_ptr) dst->sh_offset > filesize |
| 37 | + || dst->sh_size > filesize - dst->sh_offset)) |
| 38 | + { |
| 39 | +- abfd->read_only = 1; |
| 40 | + _bfd_error_handler (_("warning: %pB has a section " |
| 41 | + "extending past end of file"), abfd); |
| 42 | ++ /* PR ld/33457: Don't match corrupt section header. */ |
| 43 | ++ if (abfd->is_linker_input) |
| 44 | ++ return false; |
| 45 | ++ abfd->read_only = 1; |
| 46 | + } |
| 47 | + } |
| 48 | + dst->sh_link = H_GET_32 (abfd, src->sh_link); |
| 49 | +@@ -336,6 +339,7 @@ elf_swap_shdr_in (bfd *abfd, |
| 50 | + dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize); |
| 51 | + dst->bfd_section = NULL; |
| 52 | + dst->contents = NULL; |
| 53 | ++ return true; |
| 54 | + } |
| 55 | + |
| 56 | + /* Translate an ELF section header table entry in internal format into an |
| 57 | +@@ -628,9 +632,9 @@ elf_object_p (bfd *abfd) |
| 58 | + |
| 59 | + /* Read the first section header at index 0, and convert to internal |
| 60 | + form. */ |
| 61 | +- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) |
| 62 | ++ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) |
| 63 | ++ || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr)) |
| 64 | + goto got_no_match; |
| 65 | +- elf_swap_shdr_in (abfd, &x_shdr, &i_shdr); |
| 66 | + |
| 67 | + /* If the section count is zero, the actual count is in the first |
| 68 | + section header. */ |
| 69 | +@@ -716,9 +720,9 @@ elf_object_p (bfd *abfd) |
| 70 | + to internal form. */ |
| 71 | + for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++) |
| 72 | + { |
| 73 | +- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) |
| 74 | ++ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) |
| 75 | ++ || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex)) |
| 76 | + goto got_no_match; |
| 77 | +- elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex); |
| 78 | + |
| 79 | + /* Sanity check sh_link and sh_info. */ |
| 80 | + if (i_shdrp[shindex].sh_link >= num_sec) |
| 81 | +-- |
| 82 | +2.45.4 |
| 83 | + |
0 commit comments