malformed elf file causes readelf -e to hang forever

Mark Wielaard mjw at redhat.com
Mon Jan 26 15:54:34 UTC 2015


On Sun, 2015-01-25 at 15:05 -0800, Josh Stone wrote:
> On 01/25/2015 11:39 AM, Hanno Böck wrote:
> > Please see attached file, which is a malformed (fuzzed) elf file that
> > causes elfutil's readelf -e to hang, testet with the latest version
> > 0.161.
> > 
> > This was found with zzuf.
> 
> You should be fuzzing with git master, as Mark is still making a lot of
> commits for robustness.

Yes please. We made a lot of progress with elfutils 0.161, but we aren't
completely there yet. Also if possible please do add new samples to the
"Fuzzing elfutils -- various badness" bug report
https://bugzilla.redhat.com/show_bug.cgi?id=1170810
so we don't forget about any fuzzing issue found.

>   That said, I can reproduce this on master.
> 
> I'm not sure it's a hang, exactly, but it's a least a really huge loop.
> :)  I see it stuck in __libdwfl_addrsym::search_table with the end value
> of 1073741862, from the call "search_table (1, first_global)".
> 
> Debugging earlier, I see this comes from load_symtab, where the shdr is:
> 
> (gdb) p *shdr
> $4 = {
>   sh_name = 1,
>   sh_type = 2,
>   sh_flags = 0,
>   sh_addr = 0,
>   sh_offset = 7200,
>   sh_size = 1392,
>   sh_link = 33,
>   sh_info = 1073741862,
>   sh_addralign = 8,
>   sh_entsize = 24
> }
> 
> These are used as:
>     *syments = shdr->sh_size / shdr->sh_entsize;
>     *first_global = shdr->sh_info;
> 
> I guess it should be an error for first_global to be out of range, or at
> least clamp it to at most syments.

And we do that in find_symtab when we find the normal symtab or the aux
symtab. But in this case after we found the symtab we detect something
is fishy with the string table/shdrs, so we discard the result and fall
back to find_dynsym to get a backup symbol table through phdrs. Which
succeeds. dynsym only has global syms, so we don't need to set
first_global because it is initialized to zero. But... we forgot to
clear the original first_global we found when we discarded the result...
oops.

How does the following fix look?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-libdwfl-Clear-symtab-result-on-error-before-using-fi.patch
Type: text/x-patch
Size: 1885 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20150126/bacb145a/attachment.bin>


More information about the elfutils-devel mailing list