jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Detect DT_HASH chain out-of-bounds

Browse Source 
https://issues.oss-fuzz.com/u/1/issues/430110068
	modified:   p_lx_elf.cpp
This commit is contained in:
John Reiser 2025-07-24 11:09:58 -07:00 committed by Markus F.X.J. Oberhumer
parent 27f8f4f62e
commit b52d3e0772
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/p_lx_elf.cpp
View File

@ -8663,6 +8663,7 @@ Elf32_Sym const *PackLinuxElf32::elf_lookup(char const *name) const
break; // end sentinel break; // end sentinel
} }
if (n_bucket) { if (n_bucket) {
void const *EOM = file_size + (char const *)file_image.getVoidPtr();
unsigned const m = elf_hash(name) % n_bucket; unsigned const m = elf_hash(name) % n_bucket;
unsigned n_visit = 0; unsigned n_visit = 0;
unsigned si; unsigned si;
@ -8676,6 +8677,9 @@ Elf32_Sym const *PackLinuxElf32::elf_lookup(char const *name) const
return &dynsym[si]; return &dynsym[si];
if (l_sym <= &dynsym[n_visit++]) if (l_sym <= &dynsym[n_visit++])
throwCantPack("circular DT_HASH chain %d\n", si); throwCantPack("circular DT_HASH chain %d\n", si);
// Detect next si out-of-bounds
if (((unsigned int const *)EOM - chains) <= si)
throwCantPack("bad DT_HASH chain %d\n", si);
} }
} }
} }
@ -8764,6 +8768,7 @@ Elf64_Sym const *PackLinuxElf64::elf_lookup(char const *name) const
break; //end break; //end
} }
if (n_bucket) { // -rust-musl can have "empty" hashtab if (n_bucket) { // -rust-musl can have "empty" hashtab
void const *const EOM = file_size + (char const *)file_image.getVoidPtr();
unsigned const m = elf_hash(name) % n_bucket; unsigned const m = elf_hash(name) % n_bucket;
unsigned n_visit = 0; unsigned n_visit = 0;
unsigned si; unsigned si;
@ -8777,6 +8782,9 @@ Elf64_Sym const *PackLinuxElf64::elf_lookup(char const *name) const
return &dynsym[si]; return &dynsym[si];
if (l_sym <= &dynsym[n_visit++]) if (l_sym <= &dynsym[n_visit++])
throwCantPack("circular DT_HASH chain %d\n", si); throwCantPack("circular DT_HASH chain %d\n", si);
// Detect next si out-of-bounds
if (((unsigned int const *)EOM - chains) <= si)
throwCantPack("bad DT_HASH chain %d\n", si);
} }
} }
} }