[PATCH] readelf: Calculate max_entries instead of needed bytes (and overflowing).

[PATCH] readelf: Calculate max_entries instead of needed bytes (and overflowing).

[Mark Wielaard]

The afl fuzzer found that we would overflow the needed bytes when
calculating how many index entries would fit in the .debug_loclists
and .debug_rnglists tables. To fix this just calculate the max number
of entries. If the offset entry count is larger than that, do emit
an error, but print up to max_entries of offsets (so the user can
more clearly see what is wrong with their table).

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 src/ChangeLog |  7 +++++++
 src/readelf.c | 12 ++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/ChangeLog b/src/ChangeLog
index ca1917a..8ebb5fb 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,12 @@
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
+	* readelf.c (print_debug_rnglists_section): Calculate max_entries
+	instead of needed bytes to prevent overflowing. Always print
+	max_entries (but not more).
+	(print_debug_loclists_section): Likewise.
+
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
 	* readelf.c (print_debug_line_section): Stop printing directories
 	and files when we are at the end of the unit data.
 
diff --git a/src/readelf.c b/src/readelf.c
index af78f17..bbaaf96 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5656,12 +5656,12 @@ print_debug_rnglists_section (Dwfl_Module *dwflmod,
       const unsigned char *offset_array_start = readp;
       if (offset_entry_count > 0)
 	{
-	  uint64_t needed = offset_entry_count * offset_size;
-	  if (unit_length - 8 < needed)
+	  uint64_t max_entries = (unit_length - 8) / offset_size;
+	  if (offset_entry_count > max_entries)
 	    {
 	      error (0, 0,
 		     gettext ("too many offset entries for unit length"));
-	      goto next_table;
+	      offset_entry_count = max_entries;
 	    }
 
 	  printf (gettext ("  Offsets starting at 0x%" PRIx64 ":\n"),
@@ -8864,12 +8864,12 @@ print_debug_loclists_section (Dwfl_Module *dwflmod,
       const unsigned char *offset_array_start = readp;
       if (offset_entry_count > 0)
 	{
-	  uint64_t needed = offset_entry_count * offset_size;
-	  if (unit_length - 8 < needed)
+	  uint64_t max_entries = (unit_length - 8) / offset_size;
+	  if (offset_entry_count > max_entries)
 	    {
 	      error (0, 0,
 		     gettext ("too many offset entries for unit length"));
-	      goto next_table;
+	      offset_entry_count = max_entries;
 	    }
 
 	  printf (gettext ("  Offsets starting at 0x%" PRIx64 ":\n"),
-- 
1.8.3.1

Re: [PATCH] readelf: Calculate max_entries instead of needed bytes (and overflowing).

[Mark Wielaard]

On Fri, 2018-06-08 at 23:33 +0200, Mark Wielaard wrote:
> The afl fuzzer found that we would overflow the needed bytes when
> calculating how many index entries would fit in the .debug_loclists
> and .debug_rnglists tables. To fix this just calculate the max number
> of entries. If the offset entry count is larger than that, do emit
> an error, but print up to max_entries of offsets (so the user can
> more clearly see what is wrong with their table).

Pushed to master.