Skip to content

Commit 6e28ecd

Browse files
[Object][ELF] Ensure offset to locate dyn section does not go past size
Validate `p_offset` in `dynamicEntries` before computing the entry offset. Fixes: llvm#85568.
1 parent 4318f7e commit 6e28ecd

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

llvm/lib/Object/ELF.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -560,7 +560,11 @@ Expected<typename ELFT::DynRange> ELFFile<ELFT>::dynamicEntries() const {
560560

561561
for (const Elf_Phdr &Phdr : *ProgramHeadersOrError) {
562562
if (Phdr.p_type == ELF::PT_DYNAMIC) {
563-
Dyn = ArrayRef(reinterpret_cast<const Elf_Dyn *>(base() + Phdr.p_offset),
563+
const uint8_t *DynOffset = base() + Phdr.p_offset;
564+
if (DynOffset > end())
565+
return createError(
566+
"dynamic section offset past file size: corrupted ELF");
567+
Dyn = ArrayRef(reinterpret_cast<const Elf_Dyn *>(DynOffset),
564568
Phdr.p_filesz / sizeof(Elf_Dyn));
565569
break;
566570
}

0 commit comments

Comments
 (0)