Hi Sujal, Thanks for the patch, merged.
Aaron On Thu, Nov 5, 2026 at 3:32 AM Sujal Tuladhar <[email protected]> wrote: > > Hi, > > The attached patch fixes an out-of-bounds read in eu-readelf's > print_form_data when a DW_FORM_strx attribute is printed with a > str_offsets_base larger than the .debug_str_offsets section. > > The check data->d_size - str_offsets_base < val * offset_len wraps when > str_offsets_base, which comes from the file, exceeds d_size. strreadp then > points past the section, and the following (size_t) (strreadendp - strreadp) > < offset_len check wraps too, so readelf reads at a file-controlled offset. > val * offset_len can also overflow for a large ULEB128 index. libdw's > dwarf_formstring and readelf's get_indexed_addr already check the base > against the section size; the patch does the same and compares the index with > the number of entries instead of multiplying. This covers both .debug_macro > and DWARF 5 .debug_line, which share print_form_data. > > Reproducible with eu-readelf --debug-dump=macro on a crafted ELF whose > DW_AT_str_offsets_base exceeds the size of .debug_str_offsets; ASAN reports a > SEGV in print_form_data reading far past the section. The patch (git > format-patch, applies on HEAD 10b728d8) is attached. I can send the > reproducer file, or add it as a test case, if that helps. > > Thanks, > Sujal Tuladhar
