Thank you for reviewing and merging this patch. The merged commit is 656c58e1 on main.
On Tue, Nov 3, 2026 at 5:56 AM Aaron Merey <[email protected]> wrote: > Hi vivekjha, > > On Sun, Nov 1, 2026 at 10:38 AM vivek <[email protected]> wrote: > > > > add_new_section_symbols() sizes its symndx_map VLA as sh_size / > > sh_entsize - 1 elements. libelf bounds symbol accesses by sh_size > > divided by the size of one symbol, and gelf_getsymshndx() rejects only > > indices past that bound. When the stripped file's SHT_SYMTAB has an > > sh_entsize larger than the symbol size, the VLA is smaller than the > > number of symbols libelf accepts. A leading run of STT_SECTION symbols > > then makes the loop write symndx_map[i - 1] past the end of the array, > > on the stack. > > > > With AddressSanitizer this shows as a dynamic-stack-buffer-overflow, > > WRITE of size 8, at unstrip.c in add_new_section_symbols. It is > > reached by an ET_REL stripped file with sh_entsize 48 and 501 or more > > sections, and by the four-section file in the new test. > > > > Add valid_symtab_entsize () and use it where unstrip derives a symbol > > count from sh_entsize: the stripped SYMTAB and DYNSYM copy loop, and > > the merge path for the stripped and unstripped SYMTAB. A symbol table > > whose sh_entsize is not the symbol size is malformed, and is now > > rejected. This extends the sh_size < sh_entsize check of commit > > 364419bc. Symbol tables with the usual entsize are not affected. > > > > add_new_section_symbols() also refuses an old_shnum larger than nsym > > before it writes symndx_map, as defense in depth. The entsize check > > makes that case unreachable from input, but the bound stays next to > > the array it protects. > > > > Related: PR tools/34705. > > > > * src/unstrip.c (valid_symtab_entsize): New function. > > (add_new_section_symbols): Reject old_shnum larger than nsym. > > (copy_elided_sections): Use valid_symtab_entsize for the stripped > > SYMTAB and DYNSYM copy loop, and for the stripped and unstripped > > SYMTAB merge. > > * tests/run-unstrip-symtab-entsize.sh: New test script. > > * tests/testfile-unstrip-symtab2.stripped.bz2: New test file. > > * tests/testfile-unstrip-symtab2.debug.bz2: Likewise. > > * tests/Makefile.am (TESTS): Add run-unstrip-symtab-entsize.sh. > > (EXTRA_DIST): Add new test script and bz2 files. > > > > Signed-off-by: vivekjha <[email protected]> > > Thanks for the patch, it has been merged. > > Aaron > > > > >
