ctf-archive sanity checks

[Nick Alcock]

On 3 Nov 2025, Alan Modra verbalised:

> On Mon, Nov 03, 2025 at 05:04:06PM +0000, Nick Alcock wrote:
>> which is just off the end of struct ctf_archive.  So we should check
>> 
>> ctfsect->cts_size >= (sizeof (struct ctf_archive) + sizeof (uint64_t)).
>
> OK, and then there is the fact that arc->ctfa_ctfs can hold anything
> in a fuzzed object file so that needs checking too, as reported in the
> PR.  Which BTW was an uncommonly good bug report.  The reporter didn't
> just attach a fuzzed object file but reduced it to a testcase that
> could easily be the basis for a testsuite addition, and provided
> patches!

Oh, agreed! Its just... really not a threat model libctf was ever
written for (not the archive part, which I wrote, but definitely not the
rest either).

> I did consider making ctf_arc_bufpreamble look like the following,
> but decided to leave that to someone who knows what they are doing.

Honestly...

> const ctf_preamble_t *
> ctf_arc_bufpreamble (const ctf_sect_t *ctfsect)
> {
>   if (ctfsect->cts_size >= sizeof (struct ctf_archive)
>       && (le64toh ((*(uint64_t *) ctfsect->cts_data)) == CTFA_MAGIC))
>     {
>       struct ctf_archive *arc = (struct ctf_archive *) ctfsect->cts_data;
>       uint64_t preamble_off = le64toh (arc->ctfa_ctfs);
>       if (ctfsect->cts_size >= preamble_off
> 	  && (ctfsect->cts_size - preamble_off
> 	      >= sizeof (uint64_t) + sizeof (ctf_preamble_t)))
> 	return (const ctf_preamble_t *) ((char *) arc + preamble_off
> 					 + sizeof (uint64_t));
>     }
>   return (const ctf_preamble_t *) ctfsect->cts_data;
> }

We're getting something like that, phrased a bit differently (because
doing everything in one conditional is getting too complicated for me to
understand).

I'm letting it pre-emptively reutrn NULL if a couple of obvious
must-be-too-short invariants fail, and have the caller fall through to
the ordinary-archive opening code, which will already fail properly.

Patch coming, just rereading it one last time (this stuff is not
dyslexia-friendly and I don't want to make these bugs worse).

-- 
NULL && (void)