From 05bea78f46f6a0cbe13402dca0b5a363ecf66cb1 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Wed, 21 Feb 2024 22:19:32 +0100 Subject: [PATCH] readelf: Use unsigned loop variables in handle_verneed and handle_verdef Prevent signed underflow by changing loop variables to unsigned and doing count checks before decrementing. This isn't really a bug, but prevents UB detected by ubsan on fuzzed input. The bad (fuzzed) input data does get detected anyway. * src/readelf.c (handle_verneed): Use unsigned cnt, cnt2. (handle_verdef): Likewise. Signed-off-by: Mark Wielaard --- src/readelf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/readelf.c b/src/readelf.c index 802f8edec..0e931184e 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -3159,7 +3159,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr) elf_strptr (ebl->elf, shstrndx, glink->sh_name)); unsigned int offset = 0; - for (int cnt = shdr->sh_info; --cnt >= 0; ) + for (unsigned int cnt = shdr->sh_info; cnt > 0; cnt--) { /* Get the data at the next offset. */ GElf_Verneed needmem; @@ -3173,7 +3173,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr) (unsigned short int) need->vn_cnt); unsigned int auxoffset = offset + need->vn_aux; - for (int cnt2 = need->vn_cnt; --cnt2 >= 0; ) + for (unsigned int cnt2 = need->vn_cnt; cnt2 > 0; cnt2--) { GElf_Vernaux auxmem; GElf_Vernaux *aux = gelf_getvernaux (data, auxoffset, &auxmem); @@ -3236,7 +3236,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr) elf_strptr (ebl->elf, shstrndx, glink->sh_name)); unsigned int offset = 0; - for (int cnt = shdr->sh_info; --cnt >= 0; ) + for (unsigned int cnt = shdr->sh_info; cnt > 0; cnt--) { /* Get the data at the next offset. */ GElf_Verdef defmem; @@ -3259,7 +3259,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr) elf_strptr (ebl->elf, shdr->sh_link, aux->vda_name)); auxoffset += aux->vda_next; - for (int cnt2 = 1; cnt2 < def->vd_cnt; ++cnt2) + for (unsigned int cnt2 = 1; cnt2 < def->vd_cnt; ++cnt2) { aux = gelf_getverdaux (data, auxoffset, &auxmem); if (unlikely (aux == NULL)) -- 2.47.3