Re: 回复: Re: [PATCH] elf: Limit program header count to 64 [BZ #21265]

[Maciej W. Rozycki]

On Fri, 13 Feb 2026, 李腾龙 wrote:

> > This might potentially break loading of well-formed ELF objects. Also,
> > there is other alloca that are controlled by ELF header information.
>  
> After further analysis and reviewing actual ELF binaries on various systems,
> I've found that:
>  
> 1. e_phnum is uint16_t with theoretical max of 65535 (0xFFFF)
> 2. The value 0xFFFF (PN_XNUM) is a sentinel indicating extended format
>    (actual count in section header sh_info), which dl-load.c doesn't support
> 3. Typical legitimate binaries have 5-20 program headers (e.g., bash=13,
> ls=13)
> 4. System-wide scan showed maximum values well below 20
>  
> Based on this empirical data, I've revised the limit from 64 to 256 in v2:
>  
> - **256 provides 12x safety margin** over typical values
> - **Stack usage: only ~14KB** (256 * 56 bytes), well within safety limits
> - **Covers all known legitimate use cases** while preventing stack-clash
> attacks
> - **Simple and minimal code change** (~20 lines with comments)

 Arbitrary limits conflict with the GNU Coding Standards which we follow; 
cf. <https://www.gnu.org/prep/standards/standards.html#Semantics>.

  Maciej