[binutils-gdb] elfedit: segv with --enable-x86-feature

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f2172071e6b6f20a0401b68a70655930e40f6455

commit f2172071e6b6f20a0401b68a70655930e40f6455
Author: Alan Modra <amodra@gmail.com>
Date:   Wed May 28 22:29:45 2025 +0930

    elfedit: segv with --enable-x86-feature
    
            PR 33024
            PR 33025
            * elfedit.c (update_gnu_property): Sanity check program headers.

Diff:
---
 binutils/elfedit.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/binutils/elfedit.c b/binutils/elfedit.c
index 1178d8a2511..43c319f3cf4 100644
--- a/binutils/elfedit.c
+++ b/binutils/elfedit.c
@@ -105,7 +105,18 @@ update_gnu_property (const char *file_name, FILE *file)
   if (map == MAP_FAILED)
     {
       error (_("%s: mmap () failed\n"), file_name);
-      return 0;
+      return 1;
+    }
+
+  if ((elf_header.e_ident[EI_CLASS] == ELFCLASS32
+       ? sizeof (Elf32_External_Phdr)
+       : sizeof (Elf64_External_Phdr)) != elf_header.e_phentsize
+      || elf_header.e_phoff > (size_t) st_buf.st_size
+      || (elf_header.e_phnum * (size_t) elf_header.e_phentsize
+	  > st_buf.st_size - elf_header.e_phoff))
+    {
+      error (_("%s: can't read program headers\n"), file_name);
+      return 1;
     }
 
   phdrs = xmalloc (elf_header.e_phnum * sizeof (*phdrs));