Changeset 45982 in vbox for trunk

Timestamp:

May 10, 2013 12:36:39 PM (12 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

85636

Message:

RTLdrElf: Better fix.

Location:

trunk/src/VBox/Runtime/common/ldr

Files:

• ldrELF.cpp (modified) (1 diff)
• ldrELFRelocatable.cpp.h (modified) (11 diffs)

trunk/src/VBox/Runtime/common/ldr/ldrELF.cpp

@@ -49 +49 @@
 *   Defined Constants And Macros                                               *
 *******************************************************************************/
-/** Finds an ELF string. */
+/** Finds an ELF symbol table string. */
 #define ELF_STR(pHdrs, iStr) ((pHdrs)->pStr + (iStr))
+/** Finds an ELF section header string. */
+#define ELF_SH_STR(pHdrs, iStr) ((pHdrs)->pShStr + (iStr))
 
 

trunk/src/VBox/Runtime/common/ldr/ldrELFRelocatable.cpp.h

@@ -124 +124 @@
     /** Pointer to string table within RTLDRMODELF::pvBits. */
     const char             *pStr;
+
+    /** Size of the section header string table. */
+    unsigned                cbShStr;
+    /** Pointer to section header string table within RTLDRMODELF::pvBits. */
+    const char             *pShStr;
 } RTLDRMODELF, *PRTLDRMODELF;
 
@@ -148 +153 @@
         if (pModElf->iStrSh != ~0U)
             pModElf->pStr   =    (const char *)(pu8 + pModElf->paShdrs[pModElf->iStrSh].sh_offset);
+        pModElf->pShStr     =    (const char *)(pu8 + pModElf->paShdrs[pModElf->Ehdr.e_shstrndx].sh_offset);
     }
     return rc;
@@ -644 +650 @@
          */
         Log2(("rtldrELF: %s: Relocation records for #%d [%s] (sh_info=%d sh_link=%d) found in #%d [%s] (sh_info=%d sh_link=%d)\n",
-              pszLogName, (int)pShdrRel->sh_info, ELF_STR(pModElf, pShdr->sh_name), (int)pShdr->sh_info, (int)pShdr->sh_link,
-              iShdr, ELF_STR(pModElf, pShdrRel->sh_name), (int)pShdrRel->sh_info, (int)pShdrRel->sh_link));
+              pszLogName, (int)pShdrRel->sh_info, ELF_SH_STR(pModElf, pShdr->sh_name), (int)pShdr->sh_info, (int)pShdr->sh_link,
+              iShdr, ELF_SH_STR(pModElf, pShdrRel->sh_name), (int)pShdrRel->sh_info, (int)pShdrRel->sh_link));
 
         /** @todo Make RelocateSection a function pointer so we can select the one corresponding to the machine when opening the image. */
@@ -754 +760 @@
             continue;
 
-        const char *pszSectName = ELF_STR(pModElf, paShdrs[iShdr].sh_name);
+        const char *pszSectName = ELF_SH_STR(pModElf, paShdrs[iShdr].sh_name);
         if (   !strncmp(pszSectName, RT_STR_TUPLE(".debug_"))
             || !strcmp(pszSectName, ".WATCOM_references") )
@@ -830 +836 @@
     {
         RTLDRSEG Seg;
-        Seg.pchName     = ELF_STR(pModElf, paShdrs[iShdr].sh_name);
+        Seg.pchName     = ELF_SH_STR(pModElf, paShdrs[iShdr].sh_name);
         Seg.cchName     = (uint32_t)strlen(Seg.pchName);
         Seg.SelFlat     = 0;
@@ -1147 +1153 @@
     }
 
+    if (pEhdr->e_shstrndx == 0 || pEhdr->e_shstrndx > pEhdr->e_shnum)
+    {
+        Log(("RTLdrELF: %s: The section headers string table is out of bounds! e_shstrndx=" FMT_ELF_HALF " e_shnum=" FMT_ELF_HALF "\n",
+             pszLogName, pEhdr->e_shstrndx, pEhdr->e_shnum));
+        return VERR_BAD_EXE_FORMAT;
+    }
+
     return VINF_SUCCESS;
 }
@@ -1232 +1245 @@
     }
 
+    if (pShdr->sh_name >= pModElf->cbShStr)
+    {
+        Log(("RTLdrELF: %s: Shdr #%d: sh_name (%d) is beyond the end of the section header string table (%d)!\n",
+             pszLogName, iShdr, pShdr->sh_name, pModElf->cbShStr)); NOREF(pszLogName);
+        return VERR_BAD_EXE_FORMAT;
+    }
+
     if (pShdr->sh_link >= pModElf->Ehdr.e_shnum)
     {
@@ -1330 +1350 @@
     //pModElf->paSyms         = NULL;
     pModElf->iSymSh         = ~0U;
-    pModElf->cSyms          = 0;
+    //pModElf->cSyms          = 0;
     pModElf->iStrSh         = ~0U;
-    pModElf->cbStr          = 0;
-    pModElf->cbImage        = 0;
+    //pModElf->cbStr          = 0;
+    //pModElf->cbImage        = 0;
     //pModElf->pStr           = NULL;
+    //pModElf->cbShStr        = 0;
+    //pModElf->pShStr         = NULL;
 
     /*
@@ -1367 +1389 @@
                 memcpy(&paShdrs[pModElf->Ehdr.e_shnum], paShdrs, cbShdrs);
                 pModElf->paOrgShdrs = &paShdrs[pModElf->Ehdr.e_shnum];
+
+                pModElf->cbShStr = paShdrs[pModElf->Ehdr.e_shstrndx].sh_size;
 
                 /*
@@ -1407 +1431 @@
                         AssertReturn(pModElf->cbStr == paShdrs[pModElf->iStrSh].sh_size, VERR_IMAGE_TOO_BIG);
                     }
-                    else if (paShdrs[i].sh_type == SHT_STRTAB && pModElf->iStrSh == ~0U)
+
+                    /* Special checks for the section string table. */
+                    if (i == pModElf->Ehdr.e_shstrndx)
                     {
-                        pModElf->iStrSh = i;
-                        pModElf->cbStr  = (unsigned)paShdrs[i].sh_size;
-                        AssertReturn(pModElf->cbStr == paShdrs[i].sh_size, VERR_IMAGE_TOO_BIG);
+                        if (paShdrs[i].sh_type != SHT_STRTAB)
+                        {
+                            Log(("RTLdrElf: Section header string table is not a SHT_STRTAB: %#x\n", paShdrs[i].sh_type));
+                            rc = VERR_BAD_EXE_FORMAT;
+                            break;
+                        }
+                        if (paShdrs[i].sh_size == 0)
+                        {
+                            Log(("RTLdrElf: Section header string table is empty\n"));
+                            rc = VERR_BAD_EXE_FORMAT;
+                            break;
+                        }
                     }
 
@@ -1418 +1453 @@
                 Log2(("RTLdrElf: iSymSh=%u cSyms=%u iStrSh=%u cbStr=%u rc=%Rrc cbImage=%#zx\n",
                       pModElf->iSymSh, pModElf->cSyms, pModElf->iStrSh, pModElf->cbStr, rc, pModElf->cbImage));
-#if 0
-                /*
-                 * Are the section headers fine?
-                 * We require there to be symbol & string tables (at least for the time being).
-                 */
-                if (    pModElf->iSymSh == ~0U
-                    ||  pModElf->iStrSh == ~0U)
-                    rc = VERR_LDRELF_NO_SYMBOL_OR_NO_STRING_TABS;
-#endif
                 if (RT_SUCCESS(rc))
                 {