Don't trust the elf version given by the file. It could be completely bogus. In which case gelf_fsize just returns zero. Which could cause divide by zero errors.
https://bugzilla.redhat.com/show_bug.cgi?id=1170810#c34
Signed-off-by: Mark Wielaard mjw@redhat.com --- libelf/ChangeLog | 4 ++++ libelf/nlist.c | 2 +- src/ChangeLog | 5 +++++ src/nm.c | 2 +- src/strip.c | 19 +++++++------------ 5 files changed, 18 insertions(+), 14 deletions(-)
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e9c2a8d..312d5cf 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,7 @@ +2015-05-08 Mark Wielaard mjw@redhat.com + + * nlist.c (nlist): Call gelf_fsize with EV_CURRENT. + 2015-01-03 Mark Wielaard mjw@redhat.com
* version_xlate.h (elf_cvt_Verdef): Use memmove to copy src to dest. diff --git a/libelf/nlist.c b/libelf/nlist.c index 41e5ff6..89fd081 100644 --- a/libelf/nlist.c +++ b/libelf/nlist.c @@ -126,7 +126,7 @@ nlist (const char *filename, struct nlist *nl)
/* How many symbols are there? */ nsyms = (shdr->sh_size - / INTUSE(gelf_fsize) (elf, ELF_T_SYM, 1, data->d_version)); + / INTUSE(gelf_fsize) (elf, ELF_T_SYM, 1, EV_CURRENT));
/* Create the hash table. */ table = nlist_fshash_init (nsyms); diff --git a/src/ChangeLog b/src/ChangeLog index e79f457..55bd4cc 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,8 @@ +2015-05-08 Mark Wielaard mjw@redhat.com + + * nm.c (show_symbols): Call gelf_fsize with EV_CURRENT. + * strip.c (handle_elf): Likewise. + 2015-05-06 Mark Wielaard mjw@redhat.com
* elflint.c (check_gnu_hash): Return early when 2nd hash function diff --git a/src/nm.c b/src/nm.c index 7d20bbb..8d19715 100644 --- a/src/nm.c +++ b/src/nm.c @@ -1166,7 +1166,7 @@ show_symbols (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, Elf_Scn *xndxscn,
/* Consistency checks. */ if (entsize == 0 - || entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, ehdr->e_version)) + || entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT)) error (0, 0, gettext ("%s: entry size in section %zd `%s' is not what we expect"), fullname, elf_ndxscn (scn), diff --git a/src/strip.c b/src/strip.c index fd3920d..365b18d 100644 --- a/src/strip.c +++ b/src/strip.c @@ -810,8 +810,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname,
/* Go through all symbols and make sure the section they reference is not removed. */ - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT);
for (size_t inner = 0; inner < shdr_info[cnt].data->d_size / elsize; @@ -1193,8 +1192,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf_Data *versiondata = NULL; Elf_Data *shndxdata = NULL;
- size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT);
if (shdr_info[cnt].symtab_idx != 0) { @@ -1487,8 +1485,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf32_Word *bucket = (Elf32_Word *) hashd->d_buf;
size_t strshndx = shdr_info[symtabidx].old_sh_link; - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT);
/* Adjust the nchain value. The symbol table size changed. We keep the same size for the bucket array. */ @@ -1541,8 +1538,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf;
size_t strshndx = shdr_info[symtabidx].old_sh_link; - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT);
/* Adjust the nchain value. The symbol table size changed. We keep the same size for the bucket array. */ @@ -1611,8 +1607,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, GElf_Half *verstab = (GElf_Half *) verd->d_buf;
/* Walk through the list and */ - size_t elsize = gelf_fsize (elf, verd->d_type, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, verd->d_type, 1, EV_CURRENT); for (size_t inner = 1; inner < verd->d_size / elsize; ++inner) if (newsymidx[inner] != 0) /* Overwriting the same array works since the @@ -1624,8 +1619,8 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, verd->d_size = gelf_fsize (newelf, verd->d_type, symd->d_size / gelf_fsize (elf, symd->d_type, 1, - ehdr->e_version), - ehdr->e_version); + EV_CURRENT), + EV_CURRENT); update_section_size (verd); break;