From patchwork Mon Oct 20 19:34:50 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: DJ Delorie X-Patchwork-Id: 122300 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id DAFCE3858C83 for ; Mon, 20 Oct 2025 19:35:55 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DAFCE3858C83 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=JVR8tjm8 X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id B287E3858C53 for ; Mon, 20 Oct 2025 19:34:59 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B287E3858C53 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org B287E3858C53 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1760988899; cv=none; b=ZjWPfE2ygqjLcbffG3gbWR7W/rd+54GUvYjXJ7VkdR/HG0uu7HbcJco717Ihfs/g6mzp7cZ23MDlyVR+eCU9fkO07aJdXqIDMmDBYK04Ubt7VowJz/VfrPFFEkROPiGXS0sRKwKcboazYvn6oLM+/gCXsxRFdC8W7srh7tTK0wE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1760988899; c=relaxed/simple; bh=vnLyDVOGPqSej2zKxPHxAvxw9sAThZLEz9gJSQW8QT0=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=R+L5PORX7ZEAvkCYExeeAxcptzIAuN8/ji13S15LzunMls45r6X27qkMnDnSFB3Fk/j4dniKXKSJ1zJhcEatd58ecZP9Ebbw/SmyTrsm8MeUgfT3p4oZOrsS0kd817guW6CLLh/AJf2eFD5U145pJ8so9PcI5HNJ+RkWUcIBdwY= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B287E3858C53 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1760988899; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to; bh=/A/vpaCsib5boAg/PLKpSguM6gfUj7QVtc+Bg3RkRn4=; b=JVR8tjm8P0AdElim9wGdJmTBbtAOKs7J6ST3t/7YyV5S3yUtUvEJFNrRapx6zq+ZR+Azf5 oVZm2A1qLXB4fjAVSrQRIjF59MFXSbgz6jRRRBlDm//I0voF+hDG2AMY9FYHTxXuKPgZYO NJGSgf1VuwezRKdOFSQRqt/SCdLQes8= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-88-puRtXgXIP569ejaHRNDWXA-1; Mon, 20 Oct 2025 15:34:56 -0400 X-MC-Unique: puRtXgXIP569ejaHRNDWXA-1 X-Mimecast-MFC-AGG-ID: puRtXgXIP569ejaHRNDWXA_1760988895 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id F29AA195608F; Mon, 20 Oct 2025 19:34:54 +0000 (UTC) Received: from greed.delorie.com (unknown [10.22.90.104]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ADBA91955F1B; Mon, 20 Oct 2025 19:34:54 +0000 (UTC) Received: from greed.delorie.com.redhat.com (localhost [127.0.0.1]) by greed.delorie.com (8.16.1/8.16.1) with ESMTP id 59KJYou92921295; Mon, 20 Oct 2025 15:34:50 -0400 From: DJ Delorie To: Paul Eggert Cc: collin.funk1@gmail.com, libc-alpha@sourceware.org Subject: [v3] sprof: check pread size and offset for overflow In-Reply-To: <80996e31-bf85-438c-a92f-dd6ed72c156b@cs.ucla.edu> (message from Paul Eggert on Fri, 17 Oct 2025 12:49:55 -0700) Date: Mon, 20 Oct 2025 15:34:50 -0400 Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: eJU7ejGKwfLRAgGFrlE9m0t885BWxLamv4kS8HeKo10_1760988895 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-10.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED, SPF_HELO_PASS, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org Add a bit of descriptive paranoia to the values we read from the ELF headers and use to access data. ---- 8< ---- v2: rewrote check math v3: add overflow checks; avoid side effects in macros Reviewed-by: Collin Funk diff --git a/elf/sprof.c b/elf/sprof.c index c82c7c9db6..e9d2a66a4f 100644 --- a/elf/sprof.c +++ b/elf/sprof.c @@ -38,6 +38,7 @@ #include #include #include +#include /* Get libc version number. */ #include "../version.h" @@ -410,6 +411,7 @@ load_shobj (const char *name) int fd; ElfW(Shdr) *shdr; size_t pagesize = getpagesize (); + struct stat st; /* Since we use dlopen() we must be prepared to work around the sometimes strange lookup rules for the shared objects. If we have a file foo.so @@ -550,14 +552,39 @@ load_shobj (const char *name) error (EXIT_FAILURE, errno, _("Reopening shared object `%s' failed"), map->l_name); + if (fstat (fd, &st) < 0) + error (EXIT_FAILURE, errno, _("stat(%s) failure"), map->l_name); + + /* We're depending on data that's being read from the file, so be a + bit paranoid here and make sure the requests are reasonable - + i.e. both size and offset are nonnegative and smaller than the + file size, as well as the offset of the end of the data. PREAD + would have failed anyway, but this is more robust and explains + what happened better. Note that SZ must be unsigned and OFF may + be signed or unsigned. */ +#define PCHECK(sz1,off1) { \ + size_t sz = sz1, end_off; \ + off_t off = off1; \ + if (sz > st.st_size \ + || off < 0 || off > st.st_size \ + || INT_ADD_WRAPV (sz, off, &end_off) \ + || end_off > st.st_size) \ + error (EXIT_FAILURE, ERANGE, \ + _("read outside of file extents %zu + %zd > %zu"), \ + sz, off, st.st_size); \ + } + /* Map the section header. */ size_t size = ehdr->e_shnum * sizeof (ElfW(Shdr)); shdr = (ElfW(Shdr) *) alloca (size); + PCHECK (size, ehdr->e_shoff); if (pread (fd, shdr, size, ehdr->e_shoff) != size) error (EXIT_FAILURE, errno, _("reading of section headers failed")); /* Get the section header string table. */ char *shstrtab = (char *) alloca (shdr[ehdr->e_shstrndx].sh_size); + PCHECK (shdr[ehdr->e_shstrndx].sh_size, + shdr[ehdr->e_shstrndx].sh_offset); if (pread (fd, shstrtab, shdr[ehdr->e_shstrndx].sh_size, shdr[ehdr->e_shstrndx].sh_offset) != shdr[ehdr->e_shstrndx].sh_size) @@ -585,6 +612,7 @@ load_shobj (const char *name) size_t size = debuglink_entry->sh_size; char *debuginfo_fname = (char *) alloca (size + 1); debuginfo_fname[size] = '\0'; + PCHECK (size, debuglink_entry->sh_offset); if (pread (fd, debuginfo_fname, size, debuglink_entry->sh_offset) != size) { @@ -638,21 +666,32 @@ load_shobj (const char *name) if (fd2 != -1) { ElfW(Ehdr) ehdr2; + struct stat st; + + if (fstat (fd2, &st) < 0) + error (EXIT_FAILURE, errno, _("stat(%s) failure"), workbuf); /* Read the ELF header. */ + PCHECK (sizeof (ehdr2), 0); if (pread (fd2, &ehdr2, sizeof (ehdr2), 0) != sizeof (ehdr2)) error (EXIT_FAILURE, errno, _("reading of ELF header failed")); /* Map the section header. */ - size_t size = ehdr2.e_shnum * sizeof (ElfW(Shdr)); + size_t size; + if (INT_MULTIPLY_WRAPV (ehdr2.e_shnum, sizeof (ElfW(Shdr)), &size)) + error (EXIT_FAILURE, errno, _("too many section headers")); + ElfW(Shdr) *shdr2 = (ElfW(Shdr) *) alloca (size); + PCHECK (size, ehdr2.e_shoff); if (pread (fd2, shdr2, size, ehdr2.e_shoff) != size) error (EXIT_FAILURE, errno, _("reading of section headers failed")); /* Get the section header string table. */ shstrtab = (char *) alloca (shdr2[ehdr2.e_shstrndx].sh_size); + PCHECK (shdr2[ehdr2.e_shstrndx].sh_size, + shdr2[ehdr2.e_shstrndx].sh_offset); if (pread (fd2, shstrtab, shdr2[ehdr2.e_shstrndx].sh_size, shdr2[ehdr2.e_shstrndx].sh_offset) != shdr2[ehdr2.e_shstrndx].sh_size)