Robust ELF header parsing.

courgette/disassembler_elf_32.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "courgette/disassembler_elf_32.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 36 matching lines @@
 
   if (header_->e_machine != ElfEM())
     return Bad("Not a supported architecture");
 
   if (header_->e_version != 1)
     return Bad("Unknown file version");
 
   if (header_->e_shentsize != sizeof(Elf32_Shdr))
     return Bad("Unexpected section header size");
 
-  if (header_->e_shoff >= length())
-    return Bad("Out of bounds section header table offset");
+  if (!IsArrayInBounds(header_->e_shoff, header_->e_shnum, sizeof(Elf32_Shdr)))
+    return Bad("Out of bounds section header table");
 
   section_header_table_ = (Elf32_Shdr *)OffsetToPointer(header_->e_shoff);
   section_header_table_size_ = header_->e_shnum;
 
-  if ((header_->e_shoff + header_->e_shnum ) >= length())
-    return Bad("Out of bounds section header table");
-
-  if (header_->e_phoff >= length())
-    return Bad("Out of bounds program header table offset");
+  if (!IsArrayInBounds(header_->e_phoff, header_->e_phnum, sizeof(Elf32_Phdr)))
+    return Bad("Out of bounds program header table");
 
   program_header_table_ = (Elf32_Phdr *)OffsetToPointer(header_->e_phoff);
   program_header_table_size_ = header_->e_phnum;
 
-  if ((header_->e_phoff + header_->e_phnum) >= length())
-    return Bad("Out of bounds program header table");
+  if (header_->e_shstrndx >= header_->e_shnum)
+    return Bad("Out of bounds string section index");
 
   default_string_section_ = (const char *)SectionBody((int)header_->e_shstrndx);
 
-  ReduceLength(DiscoverLength());
+  if (!UpdateLength()) {
+    return Bad("Out of bounds section or segment");
+  }
 
   return Good();
 }
 
 bool DisassemblerElf32::Disassemble(AssemblyProgram* target) {
   if (!ok())
     return false;
 
   // The Image Base is always 0 for ELF Executables
   target->set_image_base(0);
 
   if (!ParseAbs32Relocs())
     return false;
 
   if (!ParseRel32RelocsFromSections())
     return false;
 
   if (!ParseFile(target))
     return false;
 
   target->DefaultAssignIndexes();
 
   return true;
 }
 
-uint32 DisassemblerElf32::DiscoverLength() {
+bool DisassemblerElf32::UpdateLength() {
   uint32 result = 0;

[rickyz (no longer on Chrome), 2015/03/23 23:14:50]

Mind changing this to an Elf32_Off as well?

[halyavin2, 2015/03/24 14:35:18]

Done. 

I just realized there is one more bug to fix though. If length() is more than
4Gb, we may not notice 32-bit integer overflow. I filed crbug.com/470109.

 
   // Find the end of the last section
   for (int section_id = 0; section_id < SectionHeaderCount(); section_id++) {
     const Elf32_Shdr *section_header = SectionHeader(section_id);
 
     if (section_header->sh_type == SHT_NOBITS)
       continue;
 
+    if (!IsArrayInBounds(section_header->sh_offset, section_header->sh_size, 1))
+      return false;
+
     uint32 section_end = section_header->sh_offset + section_header->sh_size;
-
-    if (section_end > result)
-      result = section_end;
+    result = std::max(result, section_end);
   }
 
   // Find the end of the last segment
   for (int i = 0; i < ProgramSegmentHeaderCount(); i++) {
     const Elf32_Phdr *segment_header = ProgramSegmentHeader(i);
 
+    if (!IsArrayInBounds(segment_header->p_offset, segment_header->p_filesz, 1))
+      return false;
+
     uint32 segment_end = segment_header->p_offset + segment_header->p_filesz;
-
-    if (segment_end > result)
-      result = segment_end;
+    result = std::max(result, segment_end);
   }
 
   uint32 section_table_end = header_->e_shoff +
                              (header_->e_shnum * sizeof(Elf32_Shdr));
-  if (section_table_end > result)
-    result = section_table_end;
+  result = std::max(result, section_table_end);
 
   uint32 segment_table_end = header_->e_phoff +
                              (header_->e_phnum * sizeof(Elf32_Phdr));
-  if (segment_table_end > result)
-    result = segment_table_end;
+  result = std::max(result, segment_table_end);
 
-  return result;
+  ReduceLength(result);
+  return true;
 }
 
 CheckBool DisassemblerElf32::IsValidRVA(RVA rva) const {
 
   // It's valid if it's contained in any program segment
   for (int i = 0; i < ProgramSegmentHeaderCount(); i++) {
     const Elf32_Phdr *segment_header = ProgramSegmentHeader(i);
 
     if (segment_header->p_type != PT_LOAD)
       continue;
@@ skipping 344 matching lines @@
       return false;
   }
 
   std::sort(rel32_locations_.begin(),
             rel32_locations_.end(),
             TypedRVA::IsLessThan);
   return true;
 }
 
 }  // namespace courgette