An invalid BTF.ext subsection length can wrap the pointer addition used by btf_ext_parse_sec_info() on 32-bit builds. The wrapped pointer passes the bounds check and parsing then reads beyond the copied BTF.ext data.
Validate the offset and length with subtraction before forming the section
pointer.
Fixes: ae4ab4b4117d ("btf: expose API to work with raw btf_ext data")
Closes: https://issues.oss-fuzz.com/issues/477315119
Signed-off-by: Darren Carreras <[email protected]>
---
Changes in v5:
- Rebase onto bpf-next commit d114bb989367.
- Attach one diff-only patch; the v4 MIME body contained a duplicated diff and
could not be applied by CI.
Changes in v4:
- Drop the selftest because the malformed length is already rejected by the
old check on 64-bit CI; the behavioral divergence is specific to 32-bit.
- Correct the Fixes tag to the commit that introduced the pointer-based check.
Changes in v3:
- Remove the nested mbox envelope and mail headers from the Gmail attachment
so Patchwork's generated mbox applies with git am.
Changes in v2:
- Resend as plain text because Gmail mangled the v1 diff and Patchwork
reported "Patch is empty."
- Include the authorized DCO Signed-off-by line.
libbpf-btf-ext-v5.diff
Description: Binary data
