[PATCH] readelf: Fix division by zero in handle a relocation sections

[PATCH] readelf: Fix division by zero in handle a relocation sections

[Maks Mishin]

Variable 'sh_entsize', whose possible value set allows a zero value
by calling function 'gelf_fsize', is used as a denominator
in calculation of 'nentries' variable.

Found by RASU JSC.

Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com>
---
 src/readelf.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/readelf.c b/src/readelf.c
index 0e931184..6701f5cf 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -2086,6 +2086,12 @@ handle_relocs_rel (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
+
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_rel() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
@@ -2275,6 +2281,12 @@ handle_relocs_rela (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
+
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_rela() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
@@ -2469,6 +2481,12 @@ handle_relocs_relr (Ebl *ebl, Dwfl_Module *mod, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELR, 1, EV_CURRENT);
+  
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_relr() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
-- 
2.30.2

Re: [PATCH] readelf: Fix division by zero in handle a relocation sections

[Mark Wielaard]

Hi Maks,

On Sat, 2024-03-30 at 00:23 +0300, Maks Mishin wrote:
> Variable 'sh_entsize', whose possible value set allows a zero value
> by calling function 'gelf_fsize', is used as a denominator
> in calculation of 'nentries' variable.
> 
> Found by RASU JSC.

Sorry, but I am going to stop reviewing your patches till you have
responded to some of the previous reviews. All your suggested changes
are (subtly) wrong. In this case gelf_fsize cannot return zero for
example.

Please better explain your proposed changes and provide
testcases/examples of how the current code is wrong.

Thanks,

Mark