Robust ELF header parsing.

Robust ELF header parsing.

Check all out-of-bounds errors in ELF header parsing.

BUG= none
TEST= courgette_unittests

Committed: https://crrev.com/c9de6f7ae8bf4b43b239812bb203b2b0e40b86dc
Cr-Commit-Position: refs/heads/master@{#322003}

[halyavin2, 2015-03-23 05:50:41]

halyavin@chromium.org changed reviewers:
+ wfh@chromium.org

[halyavin2, 2015-03-23 05:50:42]

This fixes the biggest information leaks and crashes in ELF parser.

[Will Harris, 2015-03-23 17:39:03]

On 2015/03/23 05:50:42, halyavin2 wrote:
> This fixes the biggest information leaks and crashes in ELF parser.

+rickyz who  is loooking at elf in https://crrev.com/1003153004

[rickyz (no longer on Chrome), 2015-03-23 23:14:49]

rickyz@chromium.org changed reviewers:
+ rickyz@chromium.org

[rickyz (no longer on Chrome), 2015-03-23 23:14:50]

lgtm

Nice, thanks for fixing these!

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler.cc
File courgette/disassembler.cc (right):

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler.cc#n...
courgette/disassembler.cc:128: if (reduced_length < length_) {
Can this just be a CHECK instead?

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler_elf_...
File courgette/disassembler_elf_32.cc (right):

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler_elf_...
courgette/disassembler_elf_32.cc:103: uint32 result = 0;
Mind changing this to an Elf32_Off as well?

[Will Harris, 2015-03-23 23:18:20]

lgtm

[halyavin2, 2015-03-24 14:35:18]

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler.cc
File courgette/disassembler.cc (right):

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler.cc#n...
courgette/disassembler.cc:128: if (reduced_length < length_) {
On 2015/03/23 23:14:50, rickyz wrote:
> Can this just be a CHECK instead?

Done.

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler_elf_...
File courgette/disassembler_elf_32.cc (right):

https://codereview.chromium.org/1031513002/diff/1/courgette/disassembler_elf_...
courgette/disassembler_elf_32.cc:103: uint32 result = 0;
On 2015/03/23 at 23:14:50, rickyz wrote:
> Mind changing this to an Elf32_Off as well?

Done. 

I just realized there is one more bug to fix though. If length() is more than
4Gb, we may not notice 32-bit integer overflow. I filed crbug.com/470109.

[halyavin2, 2015-03-24 14:35:31]

The CQ bit was checked by halyavin@chromium.org

[halyavin2, 2015-03-24 14:35:32]

The patchset sent to the CQ was uploaded after l-g-t-m from rickyz@chromium.org,
wfh@chromium.org
Link to the patchset: https://codereview.chromium.org/1031513002/#ps20001
(title: "Replace uint32_t with Elf32_Off and add CHECK in ReduceLength")

[commit-bot: I haz the power, 2015-03-24 14:35:48]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1031513002/20001

[commit-bot: I haz the power, 2015-03-24 15:40:25]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-03-24 15:41:12]

Patchset 2 (id:??) landed as
https://crrev.com/c9de6f7ae8bf4b43b239812bb203b2b0e40b86dc
Cr-Commit-Position: refs/heads/master@{#322003}