[patch 3/3] Access deleted files by /dev/PID/mem

Mark Wielaard mjw at redhat.com
Mon Mar 3 16:08:26 UTC 2014


On Sun, 2014-03-02 at 22:39 +0100, Jan Kratochvil wrote:
> I could zero out the headers but I find that redundant to existing
> maximum_size protection, therefore I will implement it only upon further
> request.

If you can detect that the shdrs aren't valid then zeroing them out is
the right thing to do. There are a couple of places in libdwfl that will
try to use them instead of phdrs if the exist (also because, at least
for debuginfo files, phdrs might not be trusted). For example
dwfl_module_build_id () might not be able to find the build-id if it
sees a corrupt shdr for the main ELF file.

Cheers,

Mark



More information about the elfutils-devel mailing list