[Bug debugedit/33819] New: debugedit crashes when an object file contains 65,280 or more sections

[abbeyj at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=33819

            Bug ID: 33819
           Summary: debugedit crashes when an object file contains 65,280
                    or more sections
           Product: debugedit
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: debugedit
          Assignee: unassigned at sourceware dot org
          Reporter: abbeyj at gmail dot com
                CC: debugedit at sourceware dot org
  Target Milestone: ---

I'm not sure if this more appropriate for debugedit or for elfutils/libelf.

If you try to modify an object file that contains 65,280 or more sections then
debugedit will dereference a null pointer and crash.  Here's an example:

```
$ cat testing.cpp
template <int I>
void foo() {
}

#define F0 foo<__COUNTER__>();
#define F1 F0 F0
#define F2 F1 F1
#define F3 F2 F2
#define F4 F3 F3
#define F5 F4 F4
#define F6 F5 F5
#define F7 F6 F6
#define F8 F7 F7
#define F9 F8 F8
#define F10 F9 F9
#define F11 F10 F10
#define F12 F11 F11
#define F13 F12 F12
#define F14 F13 F13
#define F15 F14 F14

int main() {
//    F14  // approx 32779 sections
    F15  // approx 65548 sections
    return 0;
}

$ g++ -g -c testing.cpp

$ debugedit -b from -d to testing.o
Segmentation fault
```

If you comment out the `F15` line and uncomment the `F14` line then this will
run successfully.


The crash happens in libelf in elf32_updatenull.c in the
__elf64_updatenull_wrlock function at this code:

```
      if (shnum >= SHN_LORESERVE)
        {
          /* We have to  fill in the number of sections in the header
             of the zeroth section.  */
          Elf_Scn *scn0 = &elf->state.ELFW(elf,LIBELFBITS).scns.data[0];

          update_if_changed (scn0->shdr.ELFW(e,LIBELFBITS)->sh_size,
                             shnum, scn0->shdr_flags);
        }
```

Here shnum will be greater than or equal to SHN_LORESERVE (0xFF00). 
`scn0->shdr.ELFW(e,LIBELFBITS)` will resolve to `scn0->shdr.e64`.  This will be
null and will then be dereferenced by the `->sh_size`, leading to the crash.

I can work around this by wrapping the update_if_changed call with `if
(scn0->shdr.ELFW(e,LIBELFBITS))` but I'm not sure if that's the right fix or
not.

-- 
You are receiving this mail because:
You are on the CC list for the bug.