Project

General

Profile

Actions
Copy link

Bug #7141

closed

divide by zero when string table entry size is zero

Added by Dillon Amburgey over 7 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Low
Assignee:
Dillon Amburgey
Category:
cmd - userland programs
Start date:
2016-06-26
Due date:
% Done:

100%

Estimated time:
Difficulty:
Bite-size
Tags:
Gerrit CR:
External Bug:

Description

In stringtbl in usr/src/cmd/sgs/elfdump/common/elfdump.c, the symbol table entry size (and link) are checked:

                /*
                 * Validate the symbol table section.
                 */
                if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
                        (void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
                            file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
                        return (0);
                }
                if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
                        (void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
                            file, cache[ndx].c_name);
                        return (0);
                }

However the string table goes under such checking:

        /*
         * Establish the string table index.
         */
        ndx = shdr->sh_link;
        shdr = cache[ndx].c_shdr;
        /*
         * Return symbol table information.
         */
        if (symnum)
            *symnum = (shdr->sh_size / shdr->sh_entsize);

If shdr->sh_entsize is 0, a divide by zero will occur.

See the attached ELF for an example.

Files

Download all files
div_zero (9.05 KB) div_zero Dillon Amburgey, 2016-06-26 02:16 AM
div_zero_hash (9.05 KB) div_zero_hash Dillon Amburgey, 2016-06-27 04:26 AM
div_zero_got (9.05 KB) div_zero_got Dillon Amburgey, 2016-06-27 04:49 AM
div_zero_syminfo (8.16 KB) div_zero_syminfo Dillon Amburgey, 2016-06-27 05:09 AM
Actions
Copy link
 #1

Updated by Dillon Amburgey over 7 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by Dillon Amburgey over 7 years ago

The same issue exists in the hash function. Attaching an example

Actions
Copy link
 #3

Updated by Dillon Amburgey over 7 years ago

Same issue happening in processing the got

Actions
Copy link
 #4

Updated by Dillon Amburgey over 7 years ago

Same thing in syminfo

Actions
Copy link
 #5

Updated by Electric Monk about 7 years ago

  • Status changed from In Progress to Closed
  • % Done changed from 90 to 100

git commit 4520d59fda389ed57a633978297f35ae1e5c37b8

commit  4520d59fda389ed57a633978297f35ae1e5c37b8
Author: Dillon Amburgey <dillona@dillona.com>
Date:   2016-07-07T16:39:38.000Z

    7141 divide by zero when string table entry size is zero
    Reviewed by: Toomas Soome <tsoome@me.com>
    Reviewed by: Albert Lee <trisk@omniti.com>
    Approved by: Robert Mustacchi <rm@joyent.com>

Actions
Copy link

Also available in: Atom PDF