mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-11-22 18:54:02 +01:00
d2790aee19
It is possible to trigger a crash when a dynamic symbol has a
broken (too large) st_name and the DT_STRSZ is also broken.
We have the following code in the `Elf_Sym_Impl<ELFT>::getName`:
```
template <class ELFT>
Expected<StringRef> Elf_Sym_Impl<ELFT>::getName(StringRef StrTab) const {
uint32_t Offset = this->st_name;
if (Offset >= StrTab.size())
return createStringError(object_error::parse_failed,
"st_name (0x%" PRIx32
") is past the end of the string table"
" of size 0x%zx",
Offset, StrTab.size());
...
```
The problem is that `StrTab` here is a `ELFDumper::DynamicStringTab` member
which is not validated properly on initialization. So it is possible to bypass the
`if` even when the `st_name` is huge.
This patch fixes the issue.
Differential revision: https://reviews.llvm.org/D82201
|
||
|---|---|---|
| .. | ||
| ARMEHABIPrinter.h | ||
| ARMWinEHPrinter.cpp | ||
| ARMWinEHPrinter.h | ||
| CMakeLists.txt | ||
| COFFDumper.cpp | ||
| COFFImportDumper.cpp | ||
| DwarfCFIEHPrinter.h | ||
| ELFDumper.cpp | ||
| Error.cpp | ||
| Error.h | ||
| llvm-readobj.cpp | ||
| llvm-readobj.h | ||
| LLVMBuild.txt | ||
| MachODumper.cpp | ||
| ObjDumper.cpp | ||
| ObjDumper.h | ||
| StackMapPrinter.h | ||
| WasmDumper.cpp | ||
| Win64EHDumper.cpp | ||
| Win64EHDumper.h | ||
| WindowsResourceDumper.cpp | ||
| WindowsResourceDumper.h | ||
| XCOFFDumper.cpp | ||