[PATCH] elfclassify tool

Mark Wielaard mark@klomp.org
Mon Jul 29 14:24:00 GMT 2019

On Mon, Jul 29, 2019 at 10:43:56AM +0200, Florian Weimer wrote:
> * Mark Wielaard:
> > +  if (elf == NULL)
> > +    {
> > +      /* This likely means it just isn't an ELF file, probably not a
> > +	 real issue, but warn if verbose reporting.  */
> > +      if (verbose > 0)
> > +	fprintf (stderr, "warning: %s: %s\n", current_path, elf_errmsg (-1));
> > +      return false;
> > +    }
> Is it possible to distinguish the error from a memory allocation error?
> It would be wrong to mis-classify a file just because the system is low
> on memory.

You are right this is not the proper way to report the issue.
Normally, when just using elf_begin, a NULL return should be reported
through elf_issue (which will set the issues flag).

But, because I added -z, we are using either elf_begin or
dwelf_elf_begin. dwelf_elf_begin will return NULL (instead of a an
empty (ELF_K_NONE) Elf descriptor when there is an issue, or the
(decompressed) file wasn't an ELF file.

So we should split the error reporting. If we called elf_begin and get
NULL we should call elf_issue to report the proper issue.

If we called dwefl_elf_begin and we get NULL, I am not sure yet what
the proper way is to detect whether it is a real issue, or "just" not
a (decompressed) ELF file. I am afraid the current handling is the
best we can do.

Maybe we can fix dwelf_elf_begin to return an empty (ELF_K_NONE) Elf
descriptor if there was no issue, but the (decompressed) file wasn't
an ELF file.



More information about the Elfutils-devel mailing list