diff options
| author | ckitagawa <ckitagawa@chromium.org> | 2019-11-07 20:47:39 +0000 |
|---|---|---|
| committer | Copybara-Service <copybara-worker@google.com> | 2021-07-25 20:57:35 -0700 |
| commit | 5de6c9ca574332e36e10a55fffc34a7ef815a0c5 (patch) | |
| tree | 73f9a74feedd39e3feb7b10e5224f97edd63ca37 /disassembler_elf.cc | |
| parent | 45b6422b0748aef26d655db5125d888ee2be6f3d (diff) | |
| download | zucchini-5de6c9ca574332e36e10a55fffc34a7ef815a0c5.tar.gz | |
[Zucchini] Fix offset outside image case
The fuzzer found a pathological case when the section size is 0 but the
offset is outside of image. This resulted in header parsing skipping
the section since the size was 0; however, later processing creates a
region of size 0 that is outside the image causing checks to fail. The
solution here is to check if the offset is outside the image and the
size is 0. This suggests that the data is ill formed and we should
reject the image entirely.
Bug: 1019271
Change-Id: If47d099aa4f919b097d4e15804048eaf64a59201
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1903886
Reviewed-by: Etienne Pierre-Doray <etiennep@chromium.org>
Commit-Queue: Calder Kitagawa <ckitagawa@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713572}
NOKEYCHECK=True
GitOrigin-RevId: 74eb15eee824427077620f88b2e4759c5bb2e221
Diffstat (limited to 'disassembler_elf.cc')
| -rw-r--r-- | disassembler_elf.cc | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/disassembler_elf.cc b/disassembler_elf.cc index ff3b085..2405374 100644 --- a/disassembler_elf.cc +++ b/disassembler_elf.cc @@ -208,8 +208,14 @@ bool DisassemblerElf<Traits>::ParseHeader() { // Skip empty sections. These don't affect |offset_bound|, and don't // contribute to RVA-offset mapping. - if (section->sh_size == 0) + if (section->sh_size == 0) { + // Skipping empty sections is only safe if the |sh_offset| is within the + // image. Fail if this is not true as the input is ill-formed. + if (section->sh_offset >= image_.size()) + return false; + continue; + } // Extract dimensions to 32-bit integers to facilitate conversion. Range of // values was ensured above when checking that the section is bounded. |