Commit: readelf: Do not load section data from offset 0

Commit: readelf: Do not load section data from offset 0

[Nick Clifton]

Hi Guys,

  A Fedora user recently filled a bug report about readelf incorrectly
  handling an ELF file with no sections:

    https://bugzilla.redhat.com/show_bug.cgi?id=2131609

  The problem turns out to be how to distinguish between a file with
  no sections and a file with a very large number of sections, where the
  real section count is held in the first entry in the section header.

  Setting the e_shentsize field in the file header to zero is one way to
  do this, but often that is just set by default to 64.  So another test
  is to check for an e_shoff value of 0.  Since the section header and
  file header cannot both start at file offset 0, an e_shoff field of 0
  is a good indication that there are no sections.  Hence this patch.

Cheers
  Nick

binutils/ChangeLog
2022-10-03  Nick Clifton  <nickc@redhat.com>

	* readelf.c (get_32bit_section_headers): Return false if the
	e_shoff field is zero.
	(get_64bit_section_headers): Likewise.

diff --git a/binutils/readelf.c b/binutils/readelf.c
index 351571c8abb..8c6c0389fe7 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -6365,6 +6365,13 @@ get_32bit_section_headers (Filedata * filedata, bool probe)
   /* PR binutils/17531: Cope with unexpected section header sizes.  */
   if (size == 0 || num == 0)
     return false;
+
+  /* The section header cannot be at the start of the file - that is
+     where the ELF file header is located.  A file with absolutely no
+     sections in it will use a shoff of 0.  */
+  if (filedata->file_header.e_shoff == 0)
+    return false;
+
   if (size < sizeof * shdrs)
     {
       if (! probe)
@@ -6429,6 +6436,12 @@ get_64bit_section_headers (Filedata * filedata, bool probe)
   if (size == 0 || num == 0)
     return false;
 
+  /* The section header cannot be at the start of the file - that is
+     where the ELF file header is located.  A file with absolutely no
+     sections in it will use a shoff of 0.  */
+  if (filedata->file_header.e_shoff == 0)
+    return false;
+
   if (size < sizeof * shdrs)
     {
       if (! probe)