From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 4A83B3858D32 for ; Mon, 3 Oct 2022 12:19:05 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 4A83B3858D32 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1664799544; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=7MUYwpjwmiBt0VQEfSJHQ7HLdsZD+SDhxtwM3di3gy4=; b=W5JKBNir1kJhXSORj/WrjEt2KZanzXtswrdJuWY9Dh+0BPHgCsHK64PLOggxOvPutVc2zS uwXVONfMtHc9LlYW/k8pcF5xtHbSc3adSdYRjeOfTAzeor5AJgHUCBaq9uTyr2/Z4xDL7+ r4bGG0dMqCICgJOWp4oRDQ4k7yxF6HY= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-269-BNThcDJ4PFKvIoO8Kg4l9g-1; Mon, 03 Oct 2022 08:19:04 -0400 X-MC-Unique: BNThcDJ4PFKvIoO8Kg4l9g-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B2C1985A583 for ; Mon, 3 Oct 2022 12:19:03 +0000 (UTC) Received: from prancer.redhat.com (unknown [10.33.36.216]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 615AB4099B50 for ; Mon, 3 Oct 2022 12:19:03 +0000 (UTC) From: Nick Clifton To: binutils@sourceware.org Subject: Commit: readelf: Do not load section data from offset 0 Date: Mon, 03 Oct 2022 13:19:02 +0100 Message-ID: <87lepxcd6x.fsf@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,KAM_NUMSUBJECT,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Hi Guys, A Fedora user recently filled a bug report about readelf incorrectly handling an ELF file with no sections: https://bugzilla.redhat.com/show_bug.cgi?id=2131609 The problem turns out to be how to distinguish between a file with no sections and a file with a very large number of sections, where the real section count is held in the first entry in the section header. Setting the e_shentsize field in the file header to zero is one way to do this, but often that is just set by default to 64. So another test is to check for an e_shoff value of 0. Since the section header and file header cannot both start at file offset 0, an e_shoff field of 0 is a good indication that there are no sections. Hence this patch. Cheers Nick binutils/ChangeLog 2022-10-03 Nick Clifton * readelf.c (get_32bit_section_headers): Return false if the e_shoff field is zero. (get_64bit_section_headers): Likewise. diff --git a/binutils/readelf.c b/binutils/readelf.c index 351571c8abb..8c6c0389fe7 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -6365,6 +6365,13 @@ get_32bit_section_headers (Filedata * filedata, bool probe) /* PR binutils/17531: Cope with unexpected section header sizes. */ if (size == 0 || num == 0) return false; + + /* The section header cannot be at the start of the file - that is + where the ELF file header is located. A file with absolutely no + sections in it will use a shoff of 0. */ + if (filedata->file_header.e_shoff == 0) + return false; + if (size < sizeof * shdrs) { if (! probe) @@ -6429,6 +6436,12 @@ get_64bit_section_headers (Filedata * filedata, bool probe) if (size == 0 || num == 0) return false; + /* The section header cannot be at the start of the file - that is + where the ELF file header is located. A file with absolutely no + sections in it will use a shoff of 0. */ + if (filedata->file_header.e_shoff == 0) + return false; + if (size < sizeof * shdrs) { if (! probe)