mirror/ELFIO
1
0
Fork 0
mirror of https://github.com/serge1/ELFIO.git synced 2025-01-30 06:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent memory access to data out the notes' section

Browse Source
This commit is contained in:
Serge Lamikhov-Center 2022-06-19 17:37:22 +03:00
parent cb61d172bb
commit cf954a8d42
4 changed files with 46 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.vscode/launch.json vendored
View File

@ -102,7 +102,7 @@
"request": "launch", "request": "launch",
"program": "${workspaceFolder}/tests/elfio_fuzzer", "program": "${workspaceFolder}/tests/elfio_fuzzer",
"args": [ "args": [
"slow-unit-82cabac818b690bc042110f7b073e63462c7553d" "crash-98819328ee414bbba1ee50073d66c0727d60a7af"
], ],
"cwd": "${workspaceFolder}/tests", "cwd": "${workspaceFolder}/tests",
} }

21
.vscode/tasks.json vendored
View File

@ -64,7 +64,7 @@
"args": [ "args": [
"-g", "-g",
"-O0", "-O0",
"-fsanitize=fuzzer", "-fsanitize=fuzzer,address",
"-I..", "-I..",
"elfio_fuzzer.cpp", "elfio_fuzzer.cpp",
"-o", "-o",
@ -80,6 +80,25 @@
"problemMatcher": [ "problemMatcher": [
"$gcc" "$gcc"
] ]
},
{
"type": "shell",
"label": "Fuzzer Tests",
"command": "./elfio_fuzzer",
"args": [
"-jobs=8",
"corpus"
],
"options": {
"cwd": "${workspaceRoot}/tests"
},
"group": {
"kind": "build",
"isDefault": true
},
"problemMatcher": [
"$gcc"
]
} }
], ],
"version": "2.0.0" "version": "2.0.0"

12
elfio/elfio_note.hpp
View File

@ -145,14 +145,18 @@ class note_section_accessor_template
Elf_Word align = sizeof( Elf_Word ); Elf_Word align = sizeof( Elf_Word );
while ( current + (Elf_Xword)3 * align <= size ) { while ( current + (Elf_Xword)3 * align <= size ) {
note_start_positions.emplace_back( current );
Elf_Word namesz = convertor( *(const Elf_Word*)( data + current ) ); Elf_Word namesz = convertor( *(const Elf_Word*)( data + current ) );
Elf_Word descsz = convertor( Elf_Word descsz = convertor(
*(const Elf_Word*)( data + current + sizeof( namesz ) ) ); *(const Elf_Word*)( data + current + sizeof( namesz ) ) );
Elf_Word advance =
(Elf_Xword)3 * sizeof( Elf_Word ) +
( ( namesz + align - 1 ) / align ) * (Elf_Xword)align +
( ( descsz + align - 1 ) / align ) * (Elf_Xword)align;
if ( current + advance <= size ) {
note_start_positions.emplace_back( current );
}
current += (Elf_Xword)3 * sizeof( Elf_Word ) + current += advance;
( ( namesz + align - 1 ) / align ) * (Elf_Xword)align +
( ( descsz + align - 1 ) / align ) * (Elf_Xword)align;
} }
} }

18
tests/elfio_fuzzer.cpp
View File

@ -2,15 +2,31 @@
#include <sstream> #include <sstream>
#include <elfio/elfio.hpp> #include <elfio/elfio.hpp>
#include <elfio/elfio_dump.hpp>
using namespace ELFIO; using namespace ELFIO;
extern "C" int LLVMFuzzerTestOneInput( const uint8_t* Data, size_t Size ) extern "C" int LLVMFuzzerTestOneInput( const uint8_t* Data, size_t Size )
{ {
std::string str( (const char*)Data, Size ); std::string str( (const char*)Data, Size );
std::istringstream ss( str ); std::istringstream ss( str );
std::ostringstream oss;
elfio elf; elfio elf;
elf.load( ss );
if ( !elf.load( ss ) ) {
return 0;
}
dump::header( oss, elf );
dump::section_headers( oss, elf );
dump::segment_headers( oss, elf );
dump::symbol_tables( oss, elf );
dump::notes( oss, elf );
dump::modinfo( oss, elf );
dump::dynamic_tags( oss, elf );
dump::section_datas( oss, elf );
dump::segment_datas( oss, elf );
return 0; return 0;
} }