Changeset 77941 in vbox

Timestamp:

Mar 28, 2019 4:04:35 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

129661

Message:

Runtime/ldrELFRelocatable.cpp.h: several fixes

• Check that the string tables are zero terminated (in theory a crazy linker could pad the string table with non zero bytes while technically being correct and triggering a false positive with the check is something we bother with when we encounter it)
• Verify that st_name is within bounds of the string table
• Plug a few memory leaks when opening a corrupted image fails

Location:

trunk

Files:

• include/iprt/err.h (modified) (1 diff)
• src/VBox/Runtime/common/ldr/ldrELFRelocatable.cpp.h (modified) (4 diffs)

trunk/include/iprt/err.h

@@ -916 +916 @@
 /** The ELF loader didn't find the symbol/string table for the image. */
 #define VERR_LDRELF_NO_SYMBOL_OR_NO_STRING_TABS (-640)
+/** The ELF loader encountered an unterminated string table. */
+#define VERR_LDRELF_UNTERMINATED_STRING_TAB     (-641)
 /** Invalid link address. */
 #define VERR_LDR_INVALID_LINK_ADDRESS           (-647)

trunk/src/VBox/Runtime/common/ldr/ldrELFRelocatable.cpp.h

@@ -160 +160 @@
             pModElf->pStr   =    (const char *)(pu8 + pModElf->paShdrs[pModElf->iStrSh].sh_offset);
         pModElf->pShStr     =    (const char *)(pu8 + pModElf->paShdrs[pModElf->Ehdr.e_shstrndx].sh_offset);
+
+        /*
+         * Verify that the ends of the string tables have a zero terminator
+         * (this avoids duplicating the appropriate checks later in the code accessing the string tables).
+         *
+         * sh_offset and sh_size were verfied in RTLDRELF_NAME(ValidateSectionHeader)() already so they
+         * are safe to use.
+         */
+        AssertMsgStmt(   pModElf->iStrSh == ~0U
+                      || pModElf->pStr[pModElf->paShdrs[pModElf->iStrSh].sh_size - 1] == '\0',
+                      ("The string table is not zero terminated!\n"),
+                      rc = VERR_LDRELF_UNTERMINATED_STRING_TAB);
+        AssertMsgStmt(pModElf->pShStr[pModElf->paShdrs[pModElf->Ehdr.e_shstrndx].sh_size - 1] == '\0',
+                      ("The section header string table is not zero terminated!\n"),
+                      rc = VERR_LDRELF_UNTERMINATED_STRING_TAB);
+
+        if (RT_FAILURE(rc))
+        {
+            /* Unmap. */
+            int rc2 = pModElf->Core.pReader->pfnUnmap(pModElf->Core.pReader, pModElf->pvBits);
+            AssertRC(rc2);
+            pModElf->pvBits = NULL;
+            pModElf->paSyms = NULL;
+            pModElf->pStr   = NULL;
+            pModElf->pShStr = NULL;
+        }
     }
     return rc;
@@ -748 +774 @@
                 return VERR_BAD_EXE_FORMAT;
             }
+
+            AssertMsgReturn(paSyms[iSym].st_name < pModElf->cbStr,
+                            ("String outside string table! iSym=%d paSyms[iSym].st_name=%#x\n", iSym, paSyms[iSym].st_name),
+                            VERR_LDRELF_INVALID_SYMBOL_NAME_OFFSET);
+
             const char *pszName = ELF_STR(pModElf, paSyms[iSym].st_name);
+            /* String termination was already checked when the string table was mapped. */
             if (    (pszName && *pszName)
                 &&  (   (fFlags & RTLDR_ENUM_SYMBOL_FLAGS_ALL)
@@ -1930 +1962 @@
                         pModElf->iSymSh = i;
                         pModElf->cSyms  = (unsigned)(paShdrs[i].sh_size / sizeof(Elf_Sym));
-                        AssertReturn(pModElf->cSyms == paShdrs[i].sh_size / sizeof(Elf_Sym), VERR_IMAGE_TOO_BIG);
+                        AssertBreakStmt(pModElf->cSyms == paShdrs[i].sh_size / sizeof(Elf_Sym), rc = VERR_IMAGE_TOO_BIG);
                         pModElf->iStrSh = paShdrs[i].sh_link;
                         pModElf->cbStr  = (unsigned)paShdrs[pModElf->iStrSh].sh_size;
-                        AssertReturn(pModElf->cbStr == paShdrs[pModElf->iStrSh].sh_size, VERR_IMAGE_TOO_BIG);
+                        AssertBreakStmt(pModElf->cbStr == paShdrs[pModElf->iStrSh].sh_size, rc = VERR_IMAGE_TOO_BIG);
                     }
 
@@ -2004 +2036 @@
                             {
                                 pModElf->cbImage = (size_t)EndAddr;
-                                AssertMsgReturn(pModElf->cbImage == EndAddr, (FMT_ELF_ADDR "\n", EndAddr), VERR_IMAGE_TOO_BIG);
+                                AssertMsgBreakStmt(pModElf->cbImage == EndAddr, (FMT_ELF_ADDR "\n", EndAddr), rc = VERR_IMAGE_TOO_BIG);
                             }
                             Log2(("RTLdrElf: %s: Assigned " FMT_ELF_ADDR " to section #%d\n", pszLogName, paShdrs[i].sh_addr, i));