|
| 1 | +From b598030bd2734ab9e5774b0c30eafc5a1a3bf7b5 Mon Sep 17 00:00:00 2001 |
| 2 | +From: AllSpark <allspark@microsoft.com> |
| 3 | +Date: Wed, 1 Oct 2025 19:03:19 +0000 |
| 4 | +Subject: [PATCH] elf: Don't match corrupt section header in linker input (PR |
| 5 | + ld/33457) |
| 6 | + |
| 7 | +- Change elf_swap_shdr_in to return bool and return false for corrupt section headers in linker input. |
| 8 | +- Update elf_object_p to reject if elf_swap_shdr_in returns false. |
| 9 | + |
| 10 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 11 | +Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/9ca499644a21ceb3f946d1c179c38a83be084490.patch |
| 12 | +--- |
| 13 | + bfd/elfcode.h | 15 ++++++++++----- |
| 14 | + 1 file changed, 10 insertions(+), 5 deletions(-) |
| 15 | + |
| 16 | +diff --git a/binutils-2.41/bfd/elfcode.h b/binutils-2.41/bfd/elfcode.h |
| 17 | +index b2277921..67cf445c 100644 |
| 18 | +--- a/bfd/elfcode.h |
| 19 | ++++ b/bfd/elfcode.h |
| 20 | +@@ -311,7 +311,7 @@ elf_swap_ehdr_out (bfd *abfd, |
| 21 | + /* Translate an ELF section header table entry in external format into an |
| 22 | + ELF section header table entry in internal format. */ |
| 23 | + |
| 24 | +-static void |
| 25 | ++static bool |
| 26 | + elf_swap_shdr_in (bfd *abfd, |
| 27 | + const Elf_External_Shdr *src, |
| 28 | + Elf_Internal_Shdr *dst) |
| 29 | +@@ -341,6 +341,9 @@ elf_swap_shdr_in (bfd *abfd, |
| 30 | + { |
| 31 | + _bfd_error_handler (_("warning: %pB has a section " |
| 32 | + "extending past end of file"), abfd); |
| 33 | ++ /* PR ld/33457: Don't match corrupt section header. */ |
| 34 | ++ if (abfd->is_linker_input) |
| 35 | ++ return false; |
| 36 | + abfd->read_only = 1; |
| 37 | + } |
| 38 | + } |
| 39 | +@@ -350,6 +353,8 @@ elf_swap_shdr_in (bfd *abfd, |
| 40 | + dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize); |
| 41 | + dst->bfd_section = NULL; |
| 42 | + dst->contents = NULL; |
| 43 | ++ return true; |
| 44 | ++ |
| 45 | + } |
| 46 | + |
| 47 | + /* Translate an ELF section header table entry in internal format into an |
| 48 | +@@ -642,9 +647,9 @@ elf_object_p (bfd *abfd) |
| 49 | + |
| 50 | + /* Read the first section header at index 0, and convert to internal |
| 51 | + form. */ |
| 52 | +- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) |
| 53 | ++ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) |
| 54 | ++ || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr)) |
| 55 | + goto got_no_match; |
| 56 | +- elf_swap_shdr_in (abfd, &x_shdr, &i_shdr); |
| 57 | + |
| 58 | + /* If the section count is zero, the actual count is in the first |
| 59 | + section header. */ |
| 60 | +@@ -730,9 +735,9 @@ elf_object_p (bfd *abfd) |
| 61 | + to internal form. */ |
| 62 | + for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++) |
| 63 | + { |
| 64 | +- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) |
| 65 | ++ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) |
| 66 | ++ || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex)) |
| 67 | + goto got_no_match; |
| 68 | +- elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex); |
| 69 | + |
| 70 | + /* Sanity check sh_link and sh_info. */ |
| 71 | + if (i_shdrp[shindex].sh_link >= num_sec) |
| 72 | +-- |
| 73 | +2.45.4 |
| 74 | + |
0 commit comments