]> git.ipfire.org Git - thirdparty/elfutils.git/commit
libelf: fix OOB read in elf_getarsym 32-bit archive index count
author王强 <wangqiang1@kylinos.cn>
Fri, 3 Jul 2026 13:20:39 +0000 (15:20 +0200)
committerMark Wielaard <mark@klomp.org>
Fri, 3 Jul 2026 14:08:17 +0000 (16:08 +0200)
commit8b1921607772792f200ffe048698847e4895c2b3
treee8847de3ef5fbd1f86db2ad6cfb536a4db1eef0f
parent60cb1486c6fbaef2ab6a9db9007a23f5c7dcefda
libelf: fix OOB read in elf_getarsym 32-bit archive index count

read_number_entries () reads the number of entries of an archive symbol
index.  On the mmap path, taken for images created with elf_memory ()
(and for mmap-backed files), it copied sizeof (union u) == 8 bytes
instead of the width-appropriate 4 bytes for a 32-bit ("symdef") index.
For a minimal in-memory archive whose index member holds only the 4-byte
count field, this read 4 bytes past the caller's buffer.  Use w, matching
the pread path and the 64-bit case, so both paths read exactly the bytes
they need.

    * libelf/elf_getarsym.c (read_number_entries): Use w, not sizeof u,
    for the mmap memcpy.
    * tests/ar-getarsym-mem.c: New file.
    * tests/Makefile.am (check_PROGRAMS): Add ar-getarsym-mem.
    (TESTS): Likewise.
    (ar_getarsym_mem_LDADD): New variable.
    * tests/.gitignore: Add ar-getarsym-mem.

Signed-off-by: Kane Wang <wangqiang1@kylinos.cn>
libelf/elf_getarsym.c
tests/.gitignore
tests/Makefile.am
tests/ar-getarsym-mem.c [new file with mode: 0644]