From: Mark Wielaard Date: Thu, 16 Jul 2026 14:45:18 +0000 (+0200) Subject: libelf: Handle truncated symbol archive index X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=681b793e420c3b1d45b921c190edfb2adfc45b97;p=thirdparty%2Felfutils.git libelf: Handle truncated symbol archive index When checking the index_size of an / or /SYM64/ symbol archive index in elf_getarsym we only checked that the index_size contained the whole offset table, but failed to check there was also room for the count. Fix this by first making sure to check the index_size is large enough for the count (4 or 8 bytes), then check that the rest of the index_size has room for count table offset entries. https://sourceware.org/bugzilla/show_bug.cgi?id=34401 Reported-by: Karan Kurani Signed-off-by: Mark Wielaard --- diff --git a/libelf/elf_getarsym.c b/libelf/elf_getarsym.c index 79aa3bbe..2ba867ec 100644 --- a/libelf/elf_getarsym.c +++ b/libelf/elf_getarsym.c @@ -163,7 +163,7 @@ elf_getarsym (Elf *elf, size_t *ptr) __libelf_seterrno (ELF_E_NO_INDEX); goto out; } - int w = index64_p ? 8 : 4; + size_t w = index64_p ? 8 : 4; /* We have an archive. The first word in there is the number of entries in the table. */ @@ -188,7 +188,8 @@ elf_getarsym (Elf *elf, size_t *ptr) #if SIZE_MAX <= 4294967295U || n >= SIZE_MAX / sizeof (Elf_Arsym) #endif - || n > index_size / w) + || index_size < w + || n > (index_size - w) / w) { /* This index table cannot be right since it does not fit into the file. */