[PATCH] elf: Limit program header count to 64 [BZ #21265]

[Adhemerval Zanella Netto]

On 12/02/26 06:30, litenglong wrote:
> _dl_map_object_from_fd allocates 'loadcmds' on stack using e_phnum
> from ELF header.  Large e_phnum (up to 65535) can cause excessive
> stack allocation and overflow.
> 
> Fix by enforcing a limit of 64 program headers—ample for all practical
> binaries.  Loading fails with "too many program headers" if exceeded.
> 
> Security fix for CVE-2017-1000366 (stack-clash).

I think you meant BZ#26577 here [1], since BZ#21265 seems unrelated to
the issue. 

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=26577

> 
> Reviewed-by: gaoxiang <gaoxiang@kylinos.cn>
> Signed-off-by: litenglong <litenglong@kylinos.cn>
> 
> Change-Id: I38bcbb179fdfd5134f3a3d9b6a473f3cf62c7afe
> ---
>  elf/dl-load.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/elf/dl-load.c b/elf/dl-load.c
> index 7355eef..7bd8033 100644
> --- a/elf/dl-load.c
> +++ b/elf/dl-load.c
> @@ -1099,6 +1099,12 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
>  
>    {
>      /* Scan the program header table, collecting its load commands.  */
> +    /* Reject unreasonable e_phnum values to prevent stack overflow via VLA. */
> +    if (__glibc_unlikely (l->l_phnum > 64))
> +      {
> +        errstring = N_("too many program headers");
> +        goto lose;
> +      }

This might potentially break loading of well-formed ELF objects. Also,
there is other alloca that are controlled by ELF header information.

The issue would be mitigated by -fstack-clash-protection, although it
not supported on all ABIs. I think a best course of action is either
use mmap direct to allocate a temporary buffer (maybe something similar
to elf/dl-minimal-malloc.c, but with user-provided state).

>      struct loadcmd loadcmds[l->l_phnum];
>      size_t nloadcmds = 0;
>      bool has_holes = false;