summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff
diff options
context:
space:
mode:
authorRichard Purdie <rpurdie@linux.intel.com>2010-08-27 15:14:24 +0100
committerRichard Purdie <rpurdie@linux.intel.com>2010-08-27 15:29:45 +0100
commit29d6678fd546377459ef75cf54abeef5b969b5cf (patch)
tree8edd65790e37a00d01c3f203f773fe4b5012db18 /meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff
parentda49de6885ee1bc424e70bc02f21f6ab920efb55 (diff)
downloadpoky-29d6678fd546377459ef75cf54abeef5b969b5cf.tar.gz
Major layout change to the packages directory
Having one monolithic packages directory makes it hard to find things and is generally overwhelming. This commit splits it into several logical sections roughly based on function, recipes.txt gives more information about the classifications used. The opportunity is also used to switch from "packages" to "recipes" as used in OpenEmbedded as the term "packages" can be confusing to people and has many different meanings. Not all recipes have been classified yet, this is just a first pass at separating things out. Some packages are moved to meta-extras as they're no longer actively used or maintained. Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
Diffstat (limited to 'meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff')
-rw-r--r--meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff1707
1 files changed, 1707 insertions, 0 deletions
diff --git a/meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff b/meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff
new file mode 100644
index 0000000000..a186308f17
--- /dev/null
+++ b/meta/recipes-devtools/elfutils/elfutils-0.148/redhat-robustify.diff
@@ -0,0 +1,1707 @@
1Index: elfutils-0.148/libelf/ChangeLog
2===================================================================
3--- elfutils-0.148.orig/libelf/ChangeLog 2010-07-03 13:07:10.000000000 +0000
4+++ elfutils-0.148/libelf/ChangeLog 2010-07-03 13:07:11.000000000 +0000
5@@ -649,10 +649,53 @@
6 If section content hasn't been read yet, do it before looking for the
7 block size. If no section data present, infer size of section header.
8
9+2005-05-14 Jakub Jelinek <jakub@redhat.com>
10+
11+ * libelfP.h (INVALID_NDX): Define.
12+ * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any.
13+ * gelf_getlib.c (gelf_getlib): Likewise.
14+ * gelf_getmove.c (gelf_getmove): Likewise.
15+ * gelf_getrel.c (gelf_getrel): Likewise.
16+ * gelf_getrela.c (gelf_getrela): Likewise.
17+ * gelf_getsym.c (gelf_getsym): Likewise.
18+ * gelf_getsyminfo.c (gelf_getsyminfo): Likewise.
19+ * gelf_getsymshndx.c (gelf_getsymshndx): Likewise.
20+ * gelf_getversym.c (gelf_getversym): Likewise.
21+ * gelf_update_dyn.c (gelf_update_dyn): Likewise.
22+ * gelf_update_lib.c (gelf_update_lib): Likewise.
23+ * gelf_update_move.c (gelf_update_move): Likewise.
24+ * gelf_update_rel.c (gelf_update_rel): Likewise.
25+ * gelf_update_rela.c (gelf_update_rela): Likewise.
26+ * gelf_update_sym.c (gelf_update_sym): Likewise.
27+ * gelf_update_syminfo.c (gelf_update_syminfo): Likewise.
28+ * gelf_update_symshndx.c (gelf_update_symshndx): Likewise.
29+ * gelf_update_versym.c (gelf_update_versym): Likewise.
30+ * elf_newscn.c (elf_newscn): Check for overflow.
31+ * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise.
32+ (__elfw2(LIBELFBITS,updatefile)): Likewise.
33+ * elf_begin.c (file_read_elf): Likewise.
34+ * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise.
35+ * elf_getarsym.c (elf_getarsym): Likewise.
36+ * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise.
37 2005-05-11 Ulrich Drepper <drepper@redhat.com>
38
39 * elf.h: Update again.
40
41+2005-05-17 Jakub Jelinek <jakub@redhat.com>
42+
43+ * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header
44+ table fits into object's bounds.
45+ * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to
46+ elf->map_address. Check if first section header fits into object's
47+ bounds.
48+ * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)):
49+ Check if section header table fits into object's bounds.
50+ * elf_begin.c (get_shnum): Ensure section headers fits into
51+ object's bounds.
52+ (file_read_elf): Make sure scncnt is small enough to allocate both
53+ ElfXX_Shdr and Elf_Scn array. Make sure section and program header
54+ tables fit into object's bounds. Avoid memory leak on failure.
55+
56 2005-05-09 Ulrich Drepper <drepper@redhat.com>
57
58 * elf.h: Update from glibc.
59Index: elfutils-0.148/libelf/elf32_getphdr.c
60===================================================================
61--- elfutils-0.148.orig/libelf/elf32_getphdr.c 2010-04-21 14:26:40.000000000 +0000
62+++ elfutils-0.148/libelf/elf32_getphdr.c 2010-07-03 13:07:11.000000000 +0000
63@@ -114,6 +114,16 @@
64
65 if (elf->map_address != NULL)
66 {
67+ /* First see whether the information in the ELF header is
68+ valid and it does not ask for too much. */
69+ if (unlikely (ehdr->e_phoff >= elf->maximum_size)
70+ || unlikely (elf->maximum_size - ehdr->e_phoff < size))
71+ {
72+ /* Something is wrong. */
73+ __libelf_seterrno (ELF_E_INVALID_PHDR);
74+ goto out;
75+ }
76+
77 /* All the data is already mapped. Use it. */
78 void *file_phdr = ((char *) elf->map_address
79 + elf->start_offset + ehdr->e_phoff);
80Index: elfutils-0.148/libelf/elf32_getshdr.c
81===================================================================
82--- elfutils-0.148.orig/libelf/elf32_getshdr.c 2009-06-13 22:41:42.000000000 +0000
83+++ elfutils-0.148/libelf/elf32_getshdr.c 2010-07-03 13:07:11.000000000 +0000
84@@ -1,5 +1,5 @@
85 /* Return section header.
86- Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005, 2007, 2009 Red Hat, Inc.
87+ Copyright (C) 1998-2009 Red Hat, Inc.
88 This file is part of Red Hat elfutils.
89 Written by Ulrich Drepper <drepper@redhat.com>, 1998.
90
91@@ -81,7 +81,8 @@
92 goto out;
93
94 size_t shnum;
95- if (__elf_getshdrnum_rdlock (elf, &shnum) != 0)
96+ if (__elf_getshdrnum_rdlock (elf, &shnum) != 0
97+ || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr)))
98 goto out;
99 size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr));
100
101@@ -98,6 +99,16 @@
102
103 if (elf->map_address != NULL)
104 {
105+ /* First see whether the information in the ELF header is
106+ valid and it does not ask for too much. */
107+ if (unlikely (ehdr->e_shoff >= elf->maximum_size)
108+ || unlikely (elf->maximum_size - ehdr->e_shoff < size))
109+ {
110+ /* Something is wrong. */
111+ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
112+ goto free_and_out;
113+ }
114+
115 ElfW2(LIBELFBITS,Shdr) *notcvt;
116
117 /* All the data is already mapped. If we could use it
118Index: elfutils-0.148/libelf/elf32_newphdr.c
119===================================================================
120--- elfutils-0.148.orig/libelf/elf32_newphdr.c 2010-01-12 16:57:54.000000000 +0000
121+++ elfutils-0.148/libelf/elf32_newphdr.c 2010-07-03 13:07:11.000000000 +0000
122@@ -135,6 +135,12 @@
123 || count == PN_XNUM
124 || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL)
125 {
126+ if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr))))
127+ {
128+ result = NULL;
129+ goto out;
130+ }
131+
132 /* Allocate a new program header with the appropriate number of
133 elements. */
134 result = (ElfW2(LIBELFBITS,Phdr) *)
135Index: elfutils-0.148/libelf/elf32_updatefile.c
136===================================================================
137--- elfutils-0.148.orig/libelf/elf32_updatefile.c 2010-01-12 16:57:54.000000000 +0000
138+++ elfutils-0.148/libelf/elf32_updatefile.c 2010-07-03 13:07:11.000000000 +0000
139@@ -223,6 +223,9 @@
140 /* Write all the sections. Well, only those which are modified. */
141 if (shnum > 0)
142 {
143+ if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *)))
144+ return 1;
145+
146 Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns;
147 Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *));
148 char *const shdr_start = ((char *) elf->map_address + elf->start_offset
149@@ -645,6 +648,10 @@
150 /* Write all the sections. Well, only those which are modified. */
151 if (shnum > 0)
152 {
153+ if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *)
154+ + sizeof (ElfW2(LIBELFBITS,Shdr)))))
155+ return 1;
156+
157 off_t shdr_offset = elf->start_offset + ehdr->e_shoff;
158 #if EV_NUM != 2
159 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR];
160Index: elfutils-0.148/libelf/elf_begin.c
161===================================================================
162--- elfutils-0.148.orig/libelf/elf_begin.c 2010-04-21 14:26:40.000000000 +0000
163+++ elfutils-0.148/libelf/elf_begin.c 2010-07-03 13:07:11.000000000 +0000
164@@ -165,7 +165,8 @@
165
166 if (unlikely (result == 0) && ehdr.e32->e_shoff != 0)
167 {
168- if (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize)
169+ if (unlikely (ehdr.e32->e_shoff >= maxsize)
170+ || unlikely (maxsize - ehdr.e32->e_shoff < sizeof (Elf32_Shdr)))
171 /* Cannot read the first section header. */
172 return 0;
173
174@@ -213,7 +214,8 @@
175
176 if (unlikely (result == 0) && ehdr.e64->e_shoff != 0)
177 {
178- if (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)
179+ if (unlikely (ehdr.e64->e_shoff >= maxsize)
180+ || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize))
181 /* Cannot read the first section header. */
182 return 0;
183
184@@ -285,6 +287,15 @@
185 /* Could not determine the number of sections. */
186 return NULL;
187
188+ /* Check for too many sections. */
189+ if (e_ident[EI_CLASS] == ELFCLASS32)
190+ {
191+ if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr)))
192+ return NULL;
193+ }
194+ else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr)))
195+ return NULL;
196+
197 /* We can now allocate the memory. Even if there are no section headers,
198 we allocate space for a zeroth section in case we need it later. */
199 const size_t scnmax = (scncnt ?: (cmd == ELF_C_RDWR || cmd == ELF_C_RDWR_MMAP)
200@@ -324,6 +335,16 @@
201 {
202 /* We can use the mmapped memory. */
203 elf->state.elf32.ehdr = ehdr;
204+
205+ if (unlikely (ehdr->e_shoff >= maxsize)
206+ || unlikely (maxsize - ehdr->e_shoff
207+ < scncnt * sizeof (Elf32_Shdr)))
208+ {
209+ free_and_out:
210+ free (elf);
211+ __libelf_seterrno (ELF_E_INVALID_FILE);
212+ return NULL;
213+ }
214 elf->state.elf32.shdr
215 = (Elf32_Shdr *) ((char *) ehdr + ehdr->e_shoff);
216
217@@ -410,6 +431,11 @@
218 {
219 /* We can use the mmapped memory. */
220 elf->state.elf64.ehdr = ehdr;
221+
222+ if (unlikely (ehdr->e_shoff >= maxsize)
223+ || unlikely (ehdr->e_shoff
224+ + scncnt * sizeof (Elf32_Shdr) > maxsize))
225+ goto free_and_out;
226 elf->state.elf64.shdr
227 = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff);
228
229Index: elfutils-0.148/libelf/elf_getarsym.c
230===================================================================
231--- elfutils-0.148.orig/libelf/elf_getarsym.c 2009-01-08 20:56:37.000000000 +0000
232+++ elfutils-0.148/libelf/elf_getarsym.c 2010-07-03 13:07:11.000000000 +0000
233@@ -179,6 +179,9 @@
234 size_t index_size = atol (tmpbuf);
235
236 if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size
237+#if SIZE_MAX <= 4294967295U
238+ || n >= SIZE_MAX / sizeof (Elf_Arsym)
239+#endif
240 || n * sizeof (uint32_t) > index_size)
241 {
242 /* This index table cannot be right since it does not fit into
243Index: elfutils-0.148/libelf/elf_getshdrstrndx.c
244===================================================================
245--- elfutils-0.148.orig/libelf/elf_getshdrstrndx.c 2009-06-13 22:31:35.000000000 +0000
246+++ elfutils-0.148/libelf/elf_getshdrstrndx.c 2010-07-03 13:07:11.000000000 +0000
247@@ -125,10 +125,25 @@
248 if (elf->map_address != NULL
249 && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA
250 && (ALLOW_UNALIGNED
251- || (((size_t) ((char *) elf->map_address + offset))
252+ || (((size_t) ((char *) elf->map_address
253+ + elf->start_offset + offset))
254 & (__alignof__ (Elf32_Shdr) - 1)) == 0))
255- /* We can directly access the memory. */
256- num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link;
257+ {
258+ /* First see whether the information in the ELF header is
259+ valid and it does not ask for too much. */
260+ if (unlikely (elf->maximum_size - offset
261+ < sizeof (Elf32_Shdr)))
262+ {
263+ /* Something is wrong. */
264+ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
265+ result = -1;
266+ goto out;
267+ }
268+
269+ /* We can directly access the memory. */
270+ num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset
271+ + offset))->sh_link;
272+ }
273 else
274 {
275 /* We avoid reading in all the section headers. Just read
276@@ -163,10 +178,25 @@
277 if (elf->map_address != NULL
278 && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA
279 && (ALLOW_UNALIGNED
280- || (((size_t) ((char *) elf->map_address + offset))
281+ || (((size_t) ((char *) elf->map_address
282+ + elf->start_offset + offset))
283 & (__alignof__ (Elf64_Shdr) - 1)) == 0))
284- /* We can directly access the memory. */
285- num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link;
286+ {
287+ /* First see whether the information in the ELF header is
288+ valid and it does not ask for too much. */
289+ if (unlikely (elf->maximum_size - offset
290+ < sizeof (Elf64_Shdr)))
291+ {
292+ /* Something is wrong. */
293+ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
294+ result = -1;
295+ goto out;
296+ }
297+
298+ /* We can directly access the memory. */
299+ num = ((Elf64_Shdr *) (elf->map_address + elf->start_offset
300+ + offset))->sh_link;
301+ }
302 else
303 {
304 /* We avoid reading in all the section headers. Just read
305Index: elfutils-0.148/libelf/elf_newscn.c
306===================================================================
307--- elfutils-0.148.orig/libelf/elf_newscn.c 2009-01-08 20:56:37.000000000 +0000
308+++ elfutils-0.148/libelf/elf_newscn.c 2010-07-03 13:07:11.000000000 +0000
309@@ -104,10 +104,18 @@
310 else
311 {
312 /* We must allocate a new element. */
313- Elf_ScnList *newp;
314+ Elf_ScnList *newp = NULL;
315
316 assert (elf->state.elf.scnincr > 0);
317
318+ if (
319+#if SIZE_MAX <= 4294967295U
320+ likely (elf->state.elf.scnincr
321+ < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList))
322+#else
323+ 1
324+#endif
325+ )
326 newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList)
327 + ((elf->state.elf.scnincr *= 2)
328 * sizeof (Elf_Scn)), 1);
329Index: elfutils-0.148/libelf/gelf_getdyn.c
330===================================================================
331--- elfutils-0.148.orig/libelf/gelf_getdyn.c 2009-01-08 20:56:37.000000000 +0000
332+++ elfutils-0.148/libelf/gelf_getdyn.c 2010-07-03 13:07:11.000000000 +0000
333@@ -1,5 +1,5 @@
334 /* Get information from dynamic table at the given index.
335- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
336+ Copyright (C) 2000-2009 Red Hat, Inc.
337 This file is part of Red Hat elfutils.
338 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
339
340@@ -93,7 +93,7 @@
341 table entries has to be adopted. The user better has provided
342 a buffer where we can store the information. While copying the
343 data we are converting the format. */
344- if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
345+ if (INVALID_NDX (ndx, Elf32_Dyn, &data_scn->d))
346 {
347 __libelf_seterrno (ELF_E_INVALID_INDEX);
348 goto out;
349@@ -114,7 +114,7 @@
350
351 /* The data is already in the correct form. Just make sure the
352 index is OK. */
353- if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size))
354+ if (INVALID_NDX (ndx, GElf_Dyn, &data_scn->d))
355 {
356 __libelf_seterrno (ELF_E_INVALID_INDEX);
357 goto out;
358Index: elfutils-0.148/libelf/gelf_getlib.c
359===================================================================
360--- elfutils-0.148.orig/libelf/gelf_getlib.c 2009-01-08 20:56:37.000000000 +0000
361+++ elfutils-0.148/libelf/gelf_getlib.c 2010-07-03 13:07:11.000000000 +0000
362@@ -1,5 +1,5 @@
363 /* Get library from table at the given index.
364- Copyright (C) 2004 Red Hat, Inc.
365+ Copyright (C) 2004-2009 Red Hat, Inc.
366 This file is part of Red Hat elfutils.
367 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
368
369@@ -86,7 +86,7 @@
370 /* The data is already in the correct form. Just make sure the
371 index is OK. */
372 GElf_Lib *result = NULL;
373- if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size))
374+ if (INVALID_NDX (ndx, GElf_Lib, data))
375 __libelf_seterrno (ELF_E_INVALID_INDEX);
376 else
377 {
378Index: elfutils-0.148/libelf/gelf_getmove.c
379===================================================================
380--- elfutils-0.148.orig/libelf/gelf_getmove.c 2009-01-08 20:56:37.000000000 +0000
381+++ elfutils-0.148/libelf/gelf_getmove.c 2010-07-03 13:07:11.000000000 +0000
382@@ -1,5 +1,5 @@
383 /* Get move structure at the given index.
384- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
385+ Copyright (C) 2000-2009 Red Hat, Inc.
386 This file is part of Red Hat elfutils.
387 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
388
389@@ -83,7 +83,7 @@
390
391 /* The data is already in the correct form. Just make sure the
392 index is OK. */
393- if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size))
394+ if (INVALID_NDX (ndx, GElf_Move, data))
395 {
396 __libelf_seterrno (ELF_E_INVALID_INDEX);
397 goto out;
398Index: elfutils-0.148/libelf/gelf_getrela.c
399===================================================================
400--- elfutils-0.148.orig/libelf/gelf_getrela.c 2009-01-08 20:56:37.000000000 +0000
401+++ elfutils-0.148/libelf/gelf_getrela.c 2010-07-03 13:07:11.000000000 +0000
402@@ -1,5 +1,5 @@
403 /* Get RELA relocation information at given index.
404- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
405+ Copyright (C) 2000-2009 Red Hat, Inc.
406 This file is part of Red Hat elfutils.
407 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
408
409@@ -71,12 +71,6 @@
410 if (data_scn == NULL)
411 return NULL;
412
413- if (unlikely (ndx < 0))
414- {
415- __libelf_seterrno (ELF_E_INVALID_INDEX);
416- return NULL;
417- }
418-
419 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
420 {
421 __libelf_seterrno (ELF_E_INVALID_HANDLE);
422@@ -93,7 +87,7 @@
423 if (scn->elf->class == ELFCLASS32)
424 {
425 /* We have to convert the data. */
426- if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
427+ if (INVALID_NDX (ndx, Elf32_Rela, &data_scn->d))
428 {
429 __libelf_seterrno (ELF_E_INVALID_INDEX);
430 result = NULL;
431@@ -114,7 +108,7 @@
432 {
433 /* Simply copy the data after we made sure we are actually getting
434 correct data. */
435- if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
436+ if (INVALID_NDX (ndx, Elf64_Rela, &data_scn->d))
437 {
438 __libelf_seterrno (ELF_E_INVALID_INDEX);
439 result = NULL;
440Index: elfutils-0.148/libelf/gelf_getrel.c
441===================================================================
442--- elfutils-0.148.orig/libelf/gelf_getrel.c 2009-01-08 20:56:37.000000000 +0000
443+++ elfutils-0.148/libelf/gelf_getrel.c 2010-07-03 13:07:11.000000000 +0000
444@@ -1,5 +1,5 @@
445 /* Get REL relocation information at given index.
446- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
447+ Copyright (C) 2000-2009 Red Hat, Inc.
448 This file is part of Red Hat elfutils.
449 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
450
451@@ -71,12 +71,6 @@
452 if (data_scn == NULL)
453 return NULL;
454
455- if (unlikely (ndx < 0))
456- {
457- __libelf_seterrno (ELF_E_INVALID_INDEX);
458- return NULL;
459- }
460-
461 if (unlikely (data_scn->d.d_type != ELF_T_REL))
462 {
463 __libelf_seterrno (ELF_E_INVALID_HANDLE);
464@@ -93,7 +87,7 @@
465 if (scn->elf->class == ELFCLASS32)
466 {
467 /* We have to convert the data. */
468- if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
469+ if (INVALID_NDX (ndx, Elf32_Rel, &data_scn->d))
470 {
471 __libelf_seterrno (ELF_E_INVALID_INDEX);
472 result = NULL;
473@@ -113,7 +107,7 @@
474 {
475 /* Simply copy the data after we made sure we are actually getting
476 correct data. */
477- if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
478+ if (INVALID_NDX (ndx, Elf64_Rel, &data_scn->d))
479 {
480 __libelf_seterrno (ELF_E_INVALID_INDEX);
481 result = NULL;
482Index: elfutils-0.148/libelf/gelf_getsym.c
483===================================================================
484--- elfutils-0.148.orig/libelf/gelf_getsym.c 2009-01-08 20:56:37.000000000 +0000
485+++ elfutils-0.148/libelf/gelf_getsym.c 2010-07-03 13:07:11.000000000 +0000
486@@ -1,5 +1,5 @@
487 /* Get symbol information from symbol table at the given index.
488- Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
489+ Copyright (C) 1999-2009 Red Hat, Inc.
490 This file is part of Red Hat elfutils.
491 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
492
493@@ -90,7 +90,7 @@
494 table entries has to be adopted. The user better has provided
495 a buffer where we can store the information. While copying the
496 data we are converting the format. */
497- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size))
498+ if (INVALID_NDX (ndx, Elf32_Sym, data))
499 {
500 __libelf_seterrno (ELF_E_INVALID_INDEX);
501 goto out;
502@@ -119,7 +119,7 @@
503
504 /* The data is already in the correct form. Just make sure the
505 index is OK. */
506- if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size))
507+ if (INVALID_NDX (ndx, GElf_Sym, data))
508 {
509 __libelf_seterrno (ELF_E_INVALID_INDEX);
510 goto out;
511Index: elfutils-0.148/libelf/gelf_getsyminfo.c
512===================================================================
513--- elfutils-0.148.orig/libelf/gelf_getsyminfo.c 2009-01-08 20:56:37.000000000 +0000
514+++ elfutils-0.148/libelf/gelf_getsyminfo.c 2010-07-03 13:07:11.000000000 +0000
515@@ -1,5 +1,5 @@
516 /* Get additional symbol information from symbol table at the given index.
517- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
518+ Copyright (C) 2000-2009 Red Hat, Inc.
519 This file is part of Red Hat elfutils.
520 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
521
522@@ -84,7 +84,7 @@
523
524 /* The data is already in the correct form. Just make sure the
525 index is OK. */
526- if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size))
527+ if (INVALID_NDX (ndx, GElf_Syminfo, data))
528 {
529 __libelf_seterrno (ELF_E_INVALID_INDEX);
530 goto out;
531Index: elfutils-0.148/libelf/gelf_getsymshndx.c
532===================================================================
533--- elfutils-0.148.orig/libelf/gelf_getsymshndx.c 2009-01-08 20:56:37.000000000 +0000
534+++ elfutils-0.148/libelf/gelf_getsymshndx.c 2010-07-03 13:07:11.000000000 +0000
535@@ -1,6 +1,6 @@
536 /* Get symbol information and separate section index from symbol table
537 at the given index.
538- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
539+ Copyright (C) 2000-2009 Red Hat, Inc.
540 This file is part of Red Hat elfutils.
541 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
542
543@@ -90,7 +90,7 @@
544 section index table. */
545 if (likely (shndxdata_scn != NULL))
546 {
547- if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size))
548+ if (INVALID_NDX (ndx, Elf32_Word, &shndxdata_scn->d))
549 {
550 __libelf_seterrno (ELF_E_INVALID_INDEX);
551 goto out;
552@@ -110,7 +110,7 @@
553 table entries has to be adopted. The user better has provided
554 a buffer where we can store the information. While copying the
555 data we are converting the format. */
556- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size))
557+ if (INVALID_NDX (ndx, Elf32_Sym, symdata))
558 {
559 __libelf_seterrno (ELF_E_INVALID_INDEX);
560 goto out;
561@@ -139,7 +139,7 @@
562
563 /* The data is already in the correct form. Just make sure the
564 index is OK. */
565- if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size))
566+ if (INVALID_NDX (ndx, GElf_Sym, symdata))
567 {
568 __libelf_seterrno (ELF_E_INVALID_INDEX);
569 goto out;
570Index: elfutils-0.148/libelf/gelf_getversym.c
571===================================================================
572--- elfutils-0.148.orig/libelf/gelf_getversym.c 2009-01-08 20:56:37.000000000 +0000
573+++ elfutils-0.148/libelf/gelf_getversym.c 2010-07-03 13:07:11.000000000 +0000
574@@ -1,5 +1,5 @@
575 /* Get symbol version information at the given index.
576- Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc.
577+ Copyright (C) 1999-2009 Red Hat, Inc.
578 This file is part of Red Hat elfutils.
579 Written by Ulrich Drepper <drepper@redhat.com>, 1999.
580
581@@ -92,7 +92,7 @@
582
583 /* The data is already in the correct form. Just make sure the
584 index is OK. */
585- if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size))
586+ if (INVALID_NDX (ndx, GElf_Versym, data))
587 {
588 __libelf_seterrno (ELF_E_INVALID_INDEX);
589 result = NULL;
590Index: elfutils-0.148/libelf/gelf_update_dyn.c
591===================================================================
592--- elfutils-0.148.orig/libelf/gelf_update_dyn.c 2009-01-08 20:56:37.000000000 +0000
593+++ elfutils-0.148/libelf/gelf_update_dyn.c 2010-07-03 13:07:11.000000000 +0000
594@@ -1,5 +1,5 @@
595 /* Update information in dynamic table at the given index.
596- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
597+ Copyright (C) 2000-2009 Red Hat, Inc.
598 This file is part of Red Hat elfutils.
599 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
600
601@@ -71,12 +71,6 @@
602 if (data == NULL)
603 return 0;
604
605- if (unlikely (ndx < 0))
606- {
607- __libelf_seterrno (ELF_E_INVALID_INDEX);
608- return 0;
609- }
610-
611 if (unlikely (data_scn->d.d_type != ELF_T_DYN))
612 {
613 /* The type of the data better should match. */
614@@ -102,7 +96,7 @@
615 }
616
617 /* Check whether we have to resize the data buffer. */
618- if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size))
619+ if (INVALID_NDX (ndx, Elf32_Dyn, &data_scn->d))
620 {
621 __libelf_seterrno (ELF_E_INVALID_INDEX);
622 goto out;
623@@ -116,7 +110,7 @@
624 else
625 {
626 /* Check whether we have to resize the data buffer. */
627- if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size))
628+ if (INVALID_NDX (ndx, Elf64_Dyn, &data_scn->d))
629 {
630 __libelf_seterrno (ELF_E_INVALID_INDEX);
631 goto out;
632Index: elfutils-0.148/libelf/gelf_update_lib.c
633===================================================================
634--- elfutils-0.148.orig/libelf/gelf_update_lib.c 2009-01-08 20:56:37.000000000 +0000
635+++ elfutils-0.148/libelf/gelf_update_lib.c 2010-07-03 13:07:11.000000000 +0000
636@@ -1,5 +1,5 @@
637 /* Update library in table at the given index.
638- Copyright (C) 2004 Red Hat, Inc.
639+ Copyright (C) 2004-2009 Red Hat, Inc.
640 This file is part of Red Hat elfutils.
641 Written by Ulrich Drepper <drepper@redhat.com>, 2004.
642
643@@ -68,12 +68,6 @@
644 if (data == NULL)
645 return 0;
646
647- if (unlikely (ndx < 0))
648- {
649- __libelf_seterrno (ELF_E_INVALID_INDEX);
650- return 0;
651- }
652-
653 Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data;
654 if (unlikely (data_scn->d.d_type != ELF_T_LIB))
655 {
656@@ -87,7 +81,7 @@
657
658 /* Check whether we have to resize the data buffer. */
659 int result = 0;
660- if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size))
661+ if (INVALID_NDX (ndx, Elf64_Lib, &data_scn->d))
662 __libelf_seterrno (ELF_E_INVALID_INDEX);
663 else
664 {
665Index: elfutils-0.148/libelf/gelf_update_move.c
666===================================================================
667--- elfutils-0.148.orig/libelf/gelf_update_move.c 2009-01-08 20:56:37.000000000 +0000
668+++ elfutils-0.148/libelf/gelf_update_move.c 2010-07-03 13:07:11.000000000 +0000
669@@ -1,5 +1,5 @@
670 /* Update move structure at the given index.
671- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
672+ Copyright (C) 2000-2009 Red Hat, Inc.
673 This file is part of Red Hat elfutils.
674 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
675
676@@ -75,8 +75,7 @@
677 assert (sizeof (GElf_Move) == sizeof (Elf64_Move));
678
679 /* Check whether we have to resize the data buffer. */
680- if (unlikely (ndx < 0)
681- || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size))
682+ if (INVALID_NDX (ndx, GElf_Move, &data_scn->d))
683 {
684 __libelf_seterrno (ELF_E_INVALID_INDEX);
685 return 0;
686Index: elfutils-0.148/libelf/gelf_update_rela.c
687===================================================================
688--- elfutils-0.148.orig/libelf/gelf_update_rela.c 2009-01-08 20:56:37.000000000 +0000
689+++ elfutils-0.148/libelf/gelf_update_rela.c 2010-07-03 13:07:11.000000000 +0000
690@@ -1,5 +1,5 @@
691 /* Update RELA relocation information at given index.
692- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
693+ Copyright (C) 2000-2009 Red Hat, Inc.
694 This file is part of Red Hat elfutils.
695 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
696
697@@ -68,12 +68,6 @@
698 if (dst == NULL)
699 return 0;
700
701- if (unlikely (ndx < 0))
702- {
703- __libelf_seterrno (ELF_E_INVALID_INDEX);
704- return 0;
705- }
706-
707 if (unlikely (data_scn->d.d_type != ELF_T_RELA))
708 {
709 /* The type of the data better should match. */
710@@ -101,7 +95,7 @@
711 }
712
713 /* Check whether we have to resize the data buffer. */
714- if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size))
715+ if (INVALID_NDX (ndx, Elf32_Rela, &data_scn->d))
716 {
717 __libelf_seterrno (ELF_E_INVALID_INDEX);
718 goto out;
719@@ -117,7 +111,7 @@
720 else
721 {
722 /* Check whether we have to resize the data buffer. */
723- if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size))
724+ if (INVALID_NDX (ndx, Elf64_Rela, &data_scn->d))
725 {
726 __libelf_seterrno (ELF_E_INVALID_INDEX);
727 goto out;
728Index: elfutils-0.148/libelf/gelf_update_rel.c
729===================================================================
730--- elfutils-0.148.orig/libelf/gelf_update_rel.c 2009-01-08 20:56:37.000000000 +0000
731+++ elfutils-0.148/libelf/gelf_update_rel.c 2010-07-03 13:07:11.000000000 +0000
732@@ -1,5 +1,5 @@
733 /* Update REL relocation information at given index.
734- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
735+ Copyright (C) 2000-2009 Red Hat, Inc.
736 This file is part of Red Hat elfutils.
737 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
738
739@@ -68,12 +68,6 @@
740 if (dst == NULL)
741 return 0;
742
743- if (unlikely (ndx < 0))
744- {
745- __libelf_seterrno (ELF_E_INVALID_INDEX);
746- return 0;
747- }
748-
749 if (unlikely (data_scn->d.d_type != ELF_T_REL))
750 {
751 /* The type of the data better should match. */
752@@ -99,7 +93,7 @@
753 }
754
755 /* Check whether we have to resize the data buffer. */
756- if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size))
757+ if (INVALID_NDX (ndx, Elf32_Rel, &data_scn->d))
758 {
759 __libelf_seterrno (ELF_E_INVALID_INDEX);
760 goto out;
761@@ -114,7 +108,7 @@
762 else
763 {
764 /* Check whether we have to resize the data buffer. */
765- if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size))
766+ if (INVALID_NDX (ndx, Elf64_Rel, &data_scn->d))
767 {
768 __libelf_seterrno (ELF_E_INVALID_INDEX);
769 goto out;
770Index: elfutils-0.148/libelf/gelf_update_sym.c
771===================================================================
772--- elfutils-0.148.orig/libelf/gelf_update_sym.c 2009-01-08 20:56:37.000000000 +0000
773+++ elfutils-0.148/libelf/gelf_update_sym.c 2010-07-03 13:07:11.000000000 +0000
774@@ -1,5 +1,5 @@
775 /* Update symbol information in symbol table at the given index.
776- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
777+ Copyright (C) 2000-2009 Red Hat, Inc.
778 This file is part of Red Hat elfutils.
779 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
780
781@@ -72,12 +72,6 @@
782 if (data == NULL)
783 return 0;
784
785- if (unlikely (ndx < 0))
786- {
787- __libelf_seterrno (ELF_E_INVALID_INDEX);
788- return 0;
789- }
790-
791 if (unlikely (data_scn->d.d_type != ELF_T_SYM))
792 {
793 /* The type of the data better should match. */
794@@ -102,7 +96,7 @@
795 }
796
797 /* Check whether we have to resize the data buffer. */
798- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size))
799+ if (INVALID_NDX (ndx, Elf32_Sym, &data_scn->d))
800 {
801 __libelf_seterrno (ELF_E_INVALID_INDEX);
802 goto out;
803@@ -125,7 +119,7 @@
804 else
805 {
806 /* Check whether we have to resize the data buffer. */
807- if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size))
808+ if (INVALID_NDX (ndx, Elf64_Sym, &data_scn->d))
809 {
810 __libelf_seterrno (ELF_E_INVALID_INDEX);
811 goto out;
812Index: elfutils-0.148/libelf/gelf_update_syminfo.c
813===================================================================
814--- elfutils-0.148.orig/libelf/gelf_update_syminfo.c 2009-01-08 20:56:37.000000000 +0000
815+++ elfutils-0.148/libelf/gelf_update_syminfo.c 2010-07-03 13:07:11.000000000 +0000
816@@ -1,5 +1,5 @@
817 /* Update additional symbol information in symbol table at the given index.
818- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
819+ Copyright (C) 2000-2009 Red Hat, Inc.
820 This file is part of Red Hat elfutils.
821 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
822
823@@ -72,12 +72,6 @@
824 if (data == NULL)
825 return 0;
826
827- if (unlikely (ndx < 0))
828- {
829- __libelf_seterrno (ELF_E_INVALID_INDEX);
830- return 0;
831- }
832-
833 if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO))
834 {
835 /* The type of the data better should match. */
836@@ -93,7 +87,7 @@
837 rwlock_wrlock (scn->elf->lock);
838
839 /* Check whether we have to resize the data buffer. */
840- if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size))
841+ if (INVALID_NDX (ndx, GElf_Syminfo, &data_scn->d))
842 {
843 __libelf_seterrno (ELF_E_INVALID_INDEX);
844 goto out;
845Index: elfutils-0.148/libelf/gelf_update_symshndx.c
846===================================================================
847--- elfutils-0.148.orig/libelf/gelf_update_symshndx.c 2009-01-08 20:56:37.000000000 +0000
848+++ elfutils-0.148/libelf/gelf_update_symshndx.c 2010-07-03 13:07:11.000000000 +0000
849@@ -1,6 +1,6 @@
850 /* Update symbol information and section index in symbol table at the
851 given index.
852- Copyright (C) 2000, 2001, 2002 Red Hat, Inc.
853+ Copyright (C) 2000-2009 Red Hat, Inc.
854 This file is part of Red Hat elfutils.
855 Written by Ulrich Drepper <drepper@redhat.com>, 2000.
856
857@@ -77,12 +77,6 @@
858 if (symdata == NULL)
859 return 0;
860
861- if (unlikely (ndx < 0))
862- {
863- __libelf_seterrno (ELF_E_INVALID_INDEX);
864- return 0;
865- }
866-
867 if (unlikely (symdata_scn->d.d_type != ELF_T_SYM))
868 {
869 /* The type of the data better should match. */
870@@ -128,7 +122,7 @@
871 }
872
873 /* Check whether we have to resize the data buffer. */
874- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size))
875+ if (INVALID_NDX (ndx, Elf32_Sym, &symdata_scn->d))
876 {
877 __libelf_seterrno (ELF_E_INVALID_INDEX);
878 goto out;
879@@ -151,7 +145,7 @@
880 else
881 {
882 /* Check whether we have to resize the data buffer. */
883- if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size))
884+ if (INVALID_NDX (ndx, Elf64_Sym, &symdata_scn->d))
885 {
886 __libelf_seterrno (ELF_E_INVALID_INDEX);
887 goto out;
888Index: elfutils-0.148/libelf/gelf_update_versym.c
889===================================================================
890--- elfutils-0.148.orig/libelf/gelf_update_versym.c 2009-01-08 20:56:37.000000000 +0000
891+++ elfutils-0.148/libelf/gelf_update_versym.c 2010-07-03 13:07:11.000000000 +0000
892@@ -1,5 +1,5 @@
893 /* Update symbol version information.
894- Copyright (C) 2001, 2002 Red Hat, Inc.
895+ Copyright (C) 2001-2009 Red Hat, Inc.
896 This file is part of Red Hat elfutils.
897 Written by Ulrich Drepper <drepper@redhat.com>, 2001.
898
899@@ -75,8 +75,7 @@
900 assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym));
901
902 /* Check whether we have to resize the data buffer. */
903- if (unlikely (ndx < 0)
904- || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size))
905+ if (INVALID_NDX (ndx, GElf_Versym, &data_scn->d))
906 {
907 __libelf_seterrno (ELF_E_INVALID_INDEX);
908 return 0;
909Index: elfutils-0.148/libelf/libelfP.h
910===================================================================
911--- elfutils-0.148.orig/libelf/libelfP.h 2010-01-12 16:57:54.000000000 +0000
912+++ elfutils-0.148/libelf/libelfP.h 2010-07-03 13:07:11.000000000 +0000
913@@ -608,4 +608,8 @@
914 /* Align offset to 4 bytes as needed for note name and descriptor data. */
915 #define NOTE_ALIGN(n) (((n) + 3) & -4U)
916
917+/* Convenience macro. */
918+#define INVALID_NDX(ndx, type, data) \
919+ unlikely ((data)->d_size / sizeof (type) <= (unsigned int) (ndx))
920+
921 #endif /* libelfP.h */
922Index: elfutils-0.148/src/ChangeLog
923===================================================================
924--- elfutils-0.148.orig/src/ChangeLog 2010-07-03 13:07:10.000000000 +0000
925+++ elfutils-0.148/src/ChangeLog 2010-07-03 13:07:11.000000000 +0000
926@@ -1640,6 +1640,16 @@
927 object symbols or symbols with unknown type.
928 (check_rel): Likewise.
929
930+2005-06-09 Roland McGrath <roland@redhat.com>
931+
932+ * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link.
933+ (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise.
934+ (handle_scngrp): Check for bogus sh_info.
935+
936+ * strip.c (handle_elf): Check for bogus values in sh_link, sh_info,
937+ st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data.
938+ Don't use assert on input values, instead bail with "illformed" error.
939+
940 2005-06-08 Roland McGrath <roland@redhat.com>
941
942 * readelf.c (print_ops): Add consts.
943@@ -1690,6 +1700,19 @@
944
945 * readelf.c (dwarf_tag_string): Add new tags.
946
947+2005-05-17 Jakub Jelinek <jakub@redhat.com>
948+
949+ * elflint.c (check_hash): Don't check entries beyond end of section.
950+ (check_note): Don't crash if gelf_rawchunk fails.
951+ (section_name): Return <invalid> if gelf_getshdr returns NULL.
952+
953+2005-05-14 Jakub Jelinek <jakub@redhat.com>
954+
955+ * elflint.c (section_name): Return "<invalid>" instead of
956+ crashing on invalid section name.
957+ (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic,
958+ check_symtab_shndx, check_hash, check_versym): Robustify.
959+
960 2005-05-08 Roland McGrath <roland@redhat.com>
961
962 * strip.c (handle_elf): Don't translate hash and versym data formats,
963Index: elfutils-0.148/src/elflint.c
964===================================================================
965--- elfutils-0.148.orig/src/elflint.c 2010-04-13 20:08:02.000000000 +0000
966+++ elfutils-0.148/src/elflint.c 2010-07-03 13:07:11.000000000 +0000
967@@ -131,6 +131,10 @@
968 /* Array to count references in section groups. */
969 static int *scnref;
970
971+/* Numbers of sections and program headers. */
972+static unsigned int shnum;
973+static unsigned int phnum;
974+
975
976 int
977 main (int argc, char *argv[])
978@@ -319,10 +323,19 @@
979 {
980 GElf_Shdr shdr_mem;
981 GElf_Shdr *shdr;
982+ const char *ret;
983+
984+ if ((unsigned int) idx > shnum)
985+ return "<invalid>";
986
987 shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem);
988+ if (shdr == NULL)
989+ return "<invalid>";
990
991- return elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
992+ ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name);
993+ if (ret == NULL)
994+ return "<invalid>";
995+ return ret;
996 }
997
998
999@@ -344,11 +357,6 @@
1000 (sizeof (valid_e_machine) / sizeof (valid_e_machine[0]))
1001
1002
1003-/* Numbers of sections and program headers. */
1004-static unsigned int shnum;
1005-static unsigned int phnum;
1006-
1007-
1008 static void
1009 check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size)
1010 {
1011@@ -632,7 +640,8 @@
1012 }
1013 }
1014
1015- if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT))
1016+ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT);
1017+ if (shdr->sh_entsize != sh_entsize)
1018 ERROR (gettext ("\
1019 section [%2u] '%s': entry size is does not match ElfXX_Sym\n"),
1020 idx, section_name (ebl, idx));
1021@@ -670,7 +679,7 @@
1022 xndxscnidx, section_name (ebl, xndxscnidx));
1023 }
1024
1025- for (size_t cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1026+ for (size_t cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt)
1027 {
1028 sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx);
1029 if (sym == NULL)
1030@@ -690,7 +699,8 @@
1031 else
1032 {
1033 name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name);
1034- assert (name != NULL);
1035+ assert (name != NULL
1036+ || strshdr->sh_type != SHT_STRTAB);
1037 }
1038
1039 if (sym->st_shndx == SHN_XINDEX)
1040@@ -1038,9 +1048,11 @@
1041 {
1042 GElf_Shdr rcshdr_mem;
1043 const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem);
1044- assert (rcshdr != NULL);
1045
1046- if (rcshdr->sh_type == SHT_DYNAMIC)
1047+ if (rcshdr == NULL)
1048+ break;
1049+
1050+ if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize)
1051 {
1052 /* Found the dynamic section. Look through it. */
1053 Elf_Data *d = elf_getdata (scn, NULL);
1054@@ -1050,7 +1062,9 @@
1055 {
1056 GElf_Dyn dyn_mem;
1057 GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem);
1058- assert (dyn != NULL);
1059+
1060+ if (dyn == NULL)
1061+ break;
1062
1063 if (dyn->d_tag == DT_RELCOUNT)
1064 {
1065@@ -1064,7 +1078,9 @@
1066 /* Does the number specified number of relative
1067 relocations exceed the total number of
1068 relocations? */
1069- if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize)
1070+ if (shdr->sh_entsize != 0
1071+ && dyn->d_un.d_val > (shdr->sh_size
1072+ / shdr->sh_entsize))
1073 ERROR (gettext ("\
1074 section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"),
1075 idx, section_name (ebl, idx),
1076@@ -1224,7 +1240,8 @@
1077 }
1078 }
1079
1080- if (shdr->sh_entsize != gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT))
1081+ size_t sh_entsize = gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT);
1082+ if (shdr->sh_entsize != sh_entsize)
1083 ERROR (gettext (reltype == ELF_T_RELA ? "\
1084 section [%2d] '%s': section entry size does not match ElfXX_Rela\n" : "\
1085 section [%2d] '%s': section entry size does not match ElfXX_Rel\n"),
1086@@ -1447,7 +1464,8 @@
1087 Elf_Data *symdata = elf_getdata (symscn, NULL);
1088 enum load_state state = state_undecided;
1089
1090- for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1091+ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
1092+ for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1093 {
1094 GElf_Rela rela_mem;
1095 GElf_Rela *rela = gelf_getrela (data, cnt, &rela_mem);
1096@@ -1497,7 +1515,8 @@
1097 Elf_Data *symdata = elf_getdata (symscn, NULL);
1098 enum load_state state = state_undecided;
1099
1100- for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1101+ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
1102+ for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1103 {
1104 GElf_Rel rel_mem;
1105 GElf_Rel *rel = gelf_getrel (data, cnt, &rel_mem);
1106@@ -1600,7 +1619,8 @@
1107 shdr->sh_link, section_name (ebl, shdr->sh_link),
1108 idx, section_name (ebl, idx));
1109
1110- if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT))
1111+ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT);
1112+ if (shdr->sh_entsize != sh_entsize)
1113 ERROR (gettext ("\
1114 section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"),
1115 idx, section_name (ebl, idx));
1116@@ -1610,7 +1630,7 @@
1117 idx, section_name (ebl, idx));
1118
1119 bool non_null_warned = false;
1120- for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1121+ for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt)
1122 {
1123 GElf_Dyn dyn_mem;
1124 GElf_Dyn *dyn = gelf_getdyn (data, cnt, &dyn_mem);
1125@@ -1891,6 +1911,8 @@
1126 idx, section_name (ebl, idx));
1127
1128 if (symshdr != NULL
1129+ && shdr->sh_entsize
1130+ && symshdr->sh_entsize
1131 && (shdr->sh_size / shdr->sh_entsize
1132 < symshdr->sh_size / symshdr->sh_entsize))
1133 ERROR (gettext ("\
1134@@ -1917,6 +1939,12 @@
1135 }
1136
1137 Elf_Data *data = elf_getdata (elf_getscn (ebl->elf, idx), NULL);
1138+ if (data == NULL)
1139+ {
1140+ ERROR (gettext ("section [%2d] '%s': cannot get section data\n"),
1141+ idx, section_name (ebl, idx));
1142+ return;
1143+ }
1144
1145 if (*((Elf32_Word *) data->d_buf) != 0)
1146 ERROR (gettext ("symbol 0 should have zero extended section index\n"));
1147@@ -1959,7 +1987,7 @@
1148
1149 size_t maxidx = nchain;
1150
1151- if (symshdr != NULL)
1152+ if (symshdr != NULL && symshdr->sh_entsize != 0)
1153 {
1154 size_t symsize = symshdr->sh_size / symshdr->sh_entsize;
1155
1156@@ -1970,18 +1998,28 @@
1157 maxidx = symsize;
1158 }
1159
1160+ Elf32_Word *buf = (Elf32_Word *) data->d_buf;
1161+ Elf32_Word *end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size);
1162 size_t cnt;
1163 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1164- if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
1165+ {
1166+ if (buf + cnt >= end)
1167+ break;
1168+ else if (buf[cnt] >= maxidx)
1169 ERROR (gettext ("\
1170 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1171 idx, section_name (ebl, idx), cnt - 2);
1172+ }
1173
1174 for (; cnt < 2 + nbucket + nchain; ++cnt)
1175- if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx)
1176+ {
1177+ if (buf + cnt >= end)
1178+ break;
1179+ else if (buf[cnt] >= maxidx)
1180 ERROR (gettext ("\
1181 section [%2d] '%s': hash chain reference %zu out of bounds\n"),
1182 idx, section_name (ebl, idx), cnt - 2 - nbucket);
1183+ }
1184 }
1185
1186
1187@@ -2011,18 +2049,28 @@
1188 maxidx = symsize;
1189 }
1190
1191+ Elf64_Xword *buf = (Elf64_Xword *) data->d_buf;
1192+ Elf64_Xword *end = (Elf64_Xword *) ((char *) data->d_buf + shdr->sh_size);
1193 size_t cnt;
1194 for (cnt = 2; cnt < 2 + nbucket; ++cnt)
1195- if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
1196+ {
1197+ if (buf + cnt >= end)
1198+ break;
1199+ else if (buf[cnt] >= maxidx)
1200 ERROR (gettext ("\
1201 section [%2d] '%s': hash bucket reference %zu out of bounds\n"),
1202 idx, section_name (ebl, idx), cnt - 2);
1203+ }
1204
1205 for (; cnt < 2 + nbucket + nchain; ++cnt)
1206- if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx)
1207+ {
1208+ if (buf + cnt >= end)
1209+ break;
1210+ else if (buf[cnt] >= maxidx)
1211 ERROR (gettext ("\
1212 section [%2d] '%s': hash chain reference %" PRIu64 " out of bounds\n"),
1213- idx, section_name (ebl, idx), (uint64_t) (cnt - 2 - nbucket));
1214+ idx, section_name (ebl, idx), (uint64_t) cnt - 2 - nbucket);
1215+ }
1216 }
1217
1218
1219@@ -2047,7 +2095,7 @@
1220 if (shdr->sh_size < (4 + bitmask_words + nbuckets) * sizeof (Elf32_Word))
1221 {
1222 ERROR (gettext ("\
1223-section [%2d] '%s': hash table section is too small (is %ld, expected at least%ld)\n"),
1224+section [%2d] '%s': hash table section is too small (is %ld, expected at least %ld)\n"),
1225 idx, section_name (ebl, idx), (long int) shdr->sh_size,
1226 (long int) ((4 + bitmask_words + nbuckets) * sizeof (Elf32_Word)));
1227 return;
1228@@ -2719,8 +2767,9 @@
1229
1230 /* The number of elements in the version symbol table must be the
1231 same as the number of symbols. */
1232- if (shdr->sh_size / shdr->sh_entsize
1233- != symshdr->sh_size / symshdr->sh_entsize)
1234+ if (shdr->sh_entsize && symshdr->sh_entsize
1235+ && (shdr->sh_size / shdr->sh_entsize
1236+ != symshdr->sh_size / symshdr->sh_entsize))
1237 ERROR (gettext ("\
1238 section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"),
1239 idx, section_name (ebl, idx),
1240Index: elfutils-0.148/src/readelf.c
1241===================================================================
1242--- elfutils-0.148.orig/src/readelf.c 2010-07-03 13:07:10.000000000 +0000
1243+++ elfutils-0.148/src/readelf.c 2010-07-03 13:07:11.000000000 +0000
1244@@ -1172,6 +1172,8 @@
1245 Elf32_Word *grpref = (Elf32_Word *) data->d_buf;
1246
1247 GElf_Sym sym_mem;
1248+ GElf_Sym *sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem);
1249+
1250 printf ((grpref[0] & GRP_COMDAT)
1251 ? ngettext ("\
1252 \nCOMDAT section group [%2zu] '%s' with signature '%s' contains %zu entry:\n",
1253@@ -1184,8 +1186,8 @@
1254 data->d_size / sizeof (Elf32_Word) - 1),
1255 elf_ndxscn (scn),
1256 elf_strptr (ebl->elf, shstrndx, shdr->sh_name),
1257- elf_strptr (ebl->elf, symshdr->sh_link,
1258- gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name)
1259+ (sym == NULL ? NULL
1260+ : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name))
1261 ?: gettext ("<INVALID SYMBOL>"),
1262 data->d_size / sizeof (Elf32_Word) - 1);
1263
1264@@ -1336,7 +1338,8 @@
1265 handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
1266 {
1267 int class = gelf_getclass (ebl->elf);
1268- GElf_Shdr glink;
1269+ GElf_Shdr glink_mem;
1270+ GElf_Shdr *glink;
1271 Elf_Data *data;
1272 size_t cnt;
1273 size_t shstrndx;
1274@@ -1351,6 +1354,11 @@
1275 error (EXIT_FAILURE, 0,
1276 gettext ("cannot get section header string table index"));
1277
1278+ glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1279+ if (glink == NULL)
1280+ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1281+ elf_ndxscn (scn));
1282+
1283 printf (ngettext ("\
1284 \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1285 "\
1286@@ -1360,9 +1368,7 @@
1287 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1288 shdr->sh_offset,
1289 (int) shdr->sh_link,
1290- elf_strptr (ebl->elf, shstrndx,
1291- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1292- &glink)->sh_name));
1293+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1294 fputs_unlocked (gettext (" Type Value\n"), stdout);
1295
1296 for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1297@@ -1945,6 +1951,13 @@
1298 error (EXIT_FAILURE, 0,
1299 gettext ("cannot get section header string table index"));
1300
1301+ GElf_Shdr glink_mem;
1302+ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1303+ &glink_mem);
1304+ if (glink == NULL)
1305+ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1306+ elf_ndxscn (scn));
1307+
1308 /* Now we can compute the number of entries in the section. */
1309 unsigned int nsyms = data->d_size / (class == ELFCLASS32
1310 ? sizeof (Elf32_Sym)
1311@@ -1955,15 +1968,12 @@
1312 nsyms),
1313 (unsigned int) elf_ndxscn (scn),
1314 elf_strptr (ebl->elf, shstrndx, shdr->sh_name), nsyms);
1315- GElf_Shdr glink;
1316 printf (ngettext (" %lu local symbol String table: [%2u] '%s'\n",
1317 " %lu local symbols String table: [%2u] '%s'\n",
1318 shdr->sh_info),
1319 (unsigned long int) shdr->sh_info,
1320 (unsigned int) shdr->sh_link,
1321- elf_strptr (ebl->elf, shstrndx,
1322- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1323- &glink)->sh_name));
1324+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1325
1326 fputs_unlocked (class == ELFCLASS32
1327 ? gettext ("\
1328@@ -2199,7 +2209,13 @@
1329 error (EXIT_FAILURE, 0,
1330 gettext ("cannot get section header string table index"));
1331
1332- GElf_Shdr glink;
1333+ GElf_Shdr glink_mem;
1334+ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1335+ &glink_mem);
1336+ if (glink == NULL)
1337+ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1338+ elf_ndxscn (scn));
1339+
1340 printf (ngettext ("\
1341 \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1342 "\
1343@@ -2210,9 +2226,7 @@
1344 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1345 shdr->sh_offset,
1346 (unsigned int) shdr->sh_link,
1347- elf_strptr (ebl->elf, shstrndx,
1348- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1349- &glink)->sh_name));
1350+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1351
1352 unsigned int offset = 0;
1353 for (int cnt = shdr->sh_info; --cnt >= 0; )
1354@@ -2265,8 +2279,14 @@
1355 error (EXIT_FAILURE, 0,
1356 gettext ("cannot get section header string table index"));
1357
1358+ GElf_Shdr glink_mem;
1359+ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1360+ &glink_mem);
1361+ if (glink == NULL)
1362+ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1363+ elf_ndxscn (scn));
1364+
1365 int class = gelf_getclass (ebl->elf);
1366- GElf_Shdr glink;
1367 printf (ngettext ("\
1368 \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1369 "\
1370@@ -2278,9 +2298,7 @@
1371 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1372 shdr->sh_offset,
1373 (unsigned int) shdr->sh_link,
1374- elf_strptr (ebl->elf, shstrndx,
1375- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1376- &glink)->sh_name));
1377+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1378
1379 unsigned int offset = 0;
1380 for (int cnt = shdr->sh_info; --cnt >= 0; )
1381@@ -2542,8 +2560,14 @@
1382 filename = NULL;
1383 }
1384
1385+ GElf_Shdr glink_mem;
1386+ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1387+ &glink_mem);
1388+ if (glink == NULL)
1389+ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"),
1390+ elf_ndxscn (scn));
1391+
1392 /* Print the header. */
1393- GElf_Shdr glink;
1394 printf (ngettext ("\
1395 \nVersion symbols section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'",
1396 "\
1397@@ -2555,9 +2579,7 @@
1398 class == ELFCLASS32 ? 10 : 18, shdr->sh_addr,
1399 shdr->sh_offset,
1400 (unsigned int) shdr->sh_link,
1401- elf_strptr (ebl->elf, shstrndx,
1402- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1403- &glink)->sh_name));
1404+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1405
1406 /* Now we can finally look at the actual contents of this section. */
1407 for (unsigned int cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt)
1408@@ -2609,7 +2631,17 @@
1409 for (Elf32_Word cnt = 0; cnt < nbucket; ++cnt)
1410 ++counts[lengths[cnt]];
1411
1412- GElf_Shdr glink;
1413+ GElf_Shdr glink_mem;
1414+ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf,
1415+ shdr->sh_link),
1416+ &glink_mem);
1417+ if (glink == NULL)
1418+ {
1419+ error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1420+ elf_ndxscn (scn));
1421+ return;
1422+ }
1423+
1424 printf (ngettext ("\
1425 \nHistogram for bucket list length in section [%2u] '%s' (total of %d bucket):\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n",
1426 "\
1427@@ -2622,9 +2654,7 @@
1428 shdr->sh_addr,
1429 shdr->sh_offset,
1430 (unsigned int) shdr->sh_link,
1431- elf_strptr (ebl->elf, shstrndx,
1432- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link),
1433- &glink)->sh_name));
1434+ elf_strptr (ebl->elf, shstrndx, glink->sh_name));
1435
1436 if (extrastr != NULL)
1437 fputs (extrastr, stdout);
1438@@ -4312,6 +4342,16 @@
1439 return;
1440 }
1441
1442+ GElf_Shdr glink_mem;
1443+ GElf_Shdr *glink;
1444+ glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem);
1445+ if (glink == NULL)
1446+ {
1447+ error (0, 0, gettext ("invalid sh_link value in section %Zu"),
1448+ elf_ndxscn (scn));
1449+ return;
1450+ }
1451+
1452 printf (ngettext ("\
1453 \nDWARF section [%2zu] '%s' at offset %#" PRIx64 " contains %zu entry:\n",
1454 "\
1455Index: elfutils-0.148/src/strip.c
1456===================================================================
1457--- elfutils-0.148.orig/src/strip.c 2010-07-03 13:07:10.000000000 +0000
1458+++ elfutils-0.148/src/strip.c 2010-07-03 13:07:11.000000000 +0000
1459@@ -561,6 +561,11 @@
1460 goto fail_close;
1461 }
1462
1463+ if (shstrndx >= shnum)
1464+ goto illformed;
1465+
1466+#define elf_assert(test) do { if (!(test)) goto illformed; } while (0)
1467+
1468 /* Storage for section information. We leave room for two more
1469 entries since we unconditionally create a section header string
1470 table. Maybe some weird tool created an ELF file without one.
1471@@ -582,7 +587,7 @@
1472 {
1473 /* This should always be true (i.e., there should not be any
1474 holes in the numbering). */
1475- assert (elf_ndxscn (scn) == cnt);
1476+ elf_assert (elf_ndxscn (scn) == cnt);
1477
1478 shdr_info[cnt].scn = scn;
1479
1480@@ -595,6 +600,7 @@
1481 shdr_info[cnt].shdr.sh_name);
1482 if (shdr_info[cnt].name == NULL)
1483 {
1484+ illformed:
1485 error (0, 0, gettext ("illformed file '%s'"), fname);
1486 goto fail_close;
1487 }
1488@@ -604,6 +610,8 @@
1489
1490 /* Remember the shdr.sh_link value. */
1491 shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link;
1492+ if (shdr_info[cnt].old_sh_link >= shnum)
1493+ goto illformed;
1494
1495 /* Sections in files other than relocatable object files which
1496 are not loaded can be freely moved by us. In relocatable
1497@@ -616,7 +624,7 @@
1498 appropriate reference. */
1499 if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX))
1500 {
1501- assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1502+ elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0);
1503 shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt;
1504 }
1505 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP))
1506@@ -633,7 +641,12 @@
1507 for (inner = 1;
1508 inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word);
1509 ++inner)
1510+ {
1511+ if (grpref[inner] < shnum)
1512 shdr_info[grpref[inner]].group_idx = cnt;
1513+ else
1514+ goto illformed;
1515+ }
1516
1517 if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0))
1518 /* If the section group contains only one element and this
1519@@ -644,7 +657,7 @@
1520 }
1521 else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym))
1522 {
1523- assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1524+ elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0);
1525 shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt;
1526 }
1527
1528@@ -652,7 +665,7 @@
1529 discarded right away. */
1530 if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0)
1531 {
1532- assert (shdr_info[cnt].group_idx != 0);
1533+ elf_assert (shdr_info[cnt].group_idx != 0);
1534
1535 if (shdr_info[shdr_info[cnt].group_idx].idx == 0)
1536 {
1537@@ -727,11 +740,15 @@
1538 {
1539 /* If a relocation section is marked as being removed make
1540 sure the section it is relocating is removed, too. */
1541- if ((shdr_info[cnt].shdr.sh_type == SHT_REL
1542+ if (shdr_info[cnt].shdr.sh_type == SHT_REL
1543 || shdr_info[cnt].shdr.sh_type == SHT_RELA)
1544- && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1545+ {
1546+ if (shdr_info[cnt].shdr.sh_info >= shnum)
1547+ goto illformed;
1548+ else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0)
1549 shdr_info[cnt].idx = 1;
1550 }
1551+ }
1552
1553 if (shdr_info[cnt].idx == 1)
1554 {
1555@@ -758,7 +775,7 @@
1556 if (shdr_info[cnt].symtab_idx != 0
1557 && shdr_info[shdr_info[cnt].symtab_idx].data == NULL)
1558 {
1559- assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1560+ elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB);
1561
1562 shdr_info[shdr_info[cnt].symtab_idx].data
1563 = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1564@@ -798,6 +815,9 @@
1565 else if (scnidx == SHN_XINDEX)
1566 scnidx = xndx;
1567
1568+ if (scnidx >= shnum)
1569+ goto illformed;
1570+
1571 if (shdr_info[scnidx].idx == 0)
1572 /* This symbol table has a real symbol in
1573 a discarded section. So preserve the
1574@@ -828,12 +848,16 @@
1575 }
1576
1577 /* Handle references through sh_info. */
1578- if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)
1579- && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1580+ if (SH_INFO_LINK_P (&shdr_info[cnt].shdr))
1581+ {
1582+ if (shdr_info[cnt].shdr.sh_info >= shnum)
1583+ goto illformed;
1584+ else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0)
1585 {
1586 shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1;
1587 changes |= shdr_info[cnt].shdr.sh_info < cnt;
1588 }
1589+ }
1590
1591 /* Mark the section as investigated. */
1592 shdr_info[cnt].idx = 2;
1593@@ -972,7 +996,7 @@
1594 error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"),
1595 elf_errmsg (-1));
1596
1597- assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1598+ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1599
1600 /* Add this name to the section header string table. */
1601 shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0);
1602@@ -1009,7 +1033,7 @@
1603 error (EXIT_FAILURE, 0,
1604 gettext ("while create section header section: %s"),
1605 elf_errmsg (-1));
1606- assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1607+ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx);
1608
1609 shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn);
1610 if (shdr_info[cnt].data == NULL)
1611@@ -1065,7 +1089,7 @@
1612 error (EXIT_FAILURE, 0,
1613 gettext ("while create section header section: %s"),
1614 elf_errmsg (-1));
1615- assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1616+ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx);
1617
1618 /* Finalize the string table and fill in the correct indices in the
1619 section headers. */
1620@@ -1155,20 +1179,20 @@
1621 shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn,
1622 NULL);
1623
1624- assert ((versiondata->d_size / sizeof (Elf32_Word))
1625+ elf_assert ((versiondata->d_size / sizeof (Elf32_Word))
1626 >= shdr_info[cnt].data->d_size / elsize);
1627 }
1628
1629 if (shdr_info[cnt].version_idx != 0)
1630 {
1631- assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1632+ elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM);
1633 /* This section has associated version
1634 information. We have to modify that
1635 information, too. */
1636 versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn,
1637 NULL);
1638
1639- assert ((versiondata->d_size / sizeof (GElf_Versym))
1640+ elf_assert ((versiondata->d_size / sizeof (GElf_Versym))
1641 >= shdr_info[cnt].data->d_size / elsize);
1642 }
1643
1644@@ -1223,7 +1247,7 @@
1645 sec = shdr_info[sym->st_shndx].idx;
1646 else
1647 {
1648- assert (shndxdata != NULL);
1649+ elf_assert (shndxdata != NULL);
1650
1651 sec = shdr_info[xshndx].idx;
1652 }
1653@@ -1244,7 +1268,7 @@
1654 nxshndx = sec;
1655 }
1656
1657- assert (sec < SHN_LORESERVE || shndxdata != NULL);
1658+ elf_assert (sec < SHN_LORESERVE || shndxdata != NULL);
1659
1660 if ((inner != destidx || nshndx != sym->st_shndx
1661 || (shndxdata != NULL && nxshndx != xshndx))
1662@@ -1268,7 +1292,7 @@
1663 || shdr_info[cnt].debug_data == NULL)
1664 /* This is a section symbol for a section which has
1665 been removed. */
1666- assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1667+ elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION);
1668 }
1669
1670 if (destidx != inner)
1671@@ -1455,11 +1479,11 @@
1672 {
1673 GElf_Sym sym_mem;
1674 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1675- assert (sym != NULL);
1676+ elf_assert (sym != NULL);
1677
1678 const char *name = elf_strptr (elf, strshndx,
1679 sym->st_name);
1680- assert (name != NULL);
1681+ elf_assert (name != NULL);
1682 size_t hidx = elf_hash (name) % nbucket;
1683
1684 if (bucket[hidx] == 0)
1685@@ -1478,7 +1502,7 @@
1686 else
1687 {
1688 /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */
1689- assert (shdr_info[cnt].shdr.sh_entsize
1690+ elf_assert (shdr_info[cnt].shdr.sh_entsize
1691 == sizeof (Elf64_Xword));
1692
1693 Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
1694@@ -1509,11 +1533,11 @@
1695 {
1696 GElf_Sym sym_mem;
1697 GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem);
1698- assert (sym != NULL);
1699+ elf_assert (sym != NULL);
1700
1701 const char *name = elf_strptr (elf, strshndx,
1702 sym->st_name);
1703- assert (name != NULL);
1704+ elf_assert (name != NULL);
1705 size_t hidx = elf_hash (name) % nbucket;
1706
1707 if (bucket[hidx] == 0)
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-08 09:50:35 +0000