[PATCH] libelf: Check ELF parent size can contain ar member

[Aaron Merey]

Hi Evgeny,

On Sun, Sep 7, 2025 at 11:31 AM Evgeny <evverx@gmail.com> wrote:
> On Sun, 7 Sept 2025 at 00:58, Mark Wielaard <mark@klomp.org> wrote:
> > > I can confirm that this patch (combined with the patch where libdw_open_elf
> > > is fixed) addresses several issues reported by OSS-Fuzz. As far as I can see
> > > some issues are still reproducible but I'd wait for OSS-Fuzz to automatically
> > > close the issues it can no longer reproduce and then take a look at what's left.
> >
> > Thanks for testing. Both patches have been pushed now.
>
> OSS-Fuzz closed all the issues reported recently apart from
> https://issues.oss-fuzz.com/issues/440177309
> and https://issues.oss-fuzz.com/issues/440209723. The memory leak and
> the invalid
> read are still reproducible. I double-checked with Valgrind and added
> the backtraces
> with the testcases there.

Thanks for testing this.  I've posted a patch set that should fix both
of those issues:
https://sourceware.org/pipermail/elfutils-devel/2025q3/008572.html

I don't fully understand why this fixes the invalid read in
https://issues.oss-fuzz.com/issues/440177309 but with the patch set
applied valgrind reports no errors for both reproduces.

Aaron