Skip to content

Harden lightElf::Elf::getSectionHeader against malformed ELF headers - #2176

Open
Metastarx wants to merge 1 commit into
OpenAtom-Linyaps:masterfrom
Metastarx:patch/apps-uab-header-src-light-elf-h-168---ge
Open

Metastarx wants to merge 1 commit into
OpenAtom-Linyaps:masterfrom
Metastarx:patch/apps-uab-header-src-light-elf-h-168---ge

Conversation

@Metastarx

Copy link
Copy Markdown

Summary

Running a bundle executes the packaged uab-header, which parses the ELF trailer of the running file itself, so every field of that ELF header is controlled by whoever produced the bundle. getSectionHeader() trusted e_shentsize and sh_name directly: it read e_shentsize bytes into a fixed SectionHeader on the stack, so a value larger than the struct overflowed it, and it built a string_view from an unchecked sh_name, so an offset outside the section-name string table scanned memory past the buffer. The section header table bounds were not validated either. The fix requires e_shentsize to match sizeof(SectionHeader), checks that e_shoff plus e_shnum entries lie inside the file, always reads exactly one SectionHeader, and resolves sh_name through a lookup that validates the offset and requires a NUL terminator, skipping malformed entries instead of dereferencing them.

Verification

ctest --test-dir build-release --output-on-failure - passed (100% tests passed, 0 tests failed out of 751)

Checklist

  • I ran the verification described above
  • The change is minimal and includes no unrelated files
  • The repository contribution guidelines were followed

…r-controlled ELF header fields and overflows the stack

Signed-off-by: zhang hongyuan <100520587+Metastarx@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 13, 2026 07:13

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants