[llvm-readobj] - Validate the DT_STRSZ value to avoid crash.
authorGeorgii Rymar <grimar@accesssoftek.com>
Fri, 19 Jun 2020 15:37:15 +0000 (18:37 +0300)
committerGeorgii Rymar <grimar@accesssoftek.com>
Mon, 22 Jun 2020 12:24:59 +0000 (15:24 +0300)
commitba808b157e84774e8f384d9436c911c1341105cd
tree0e7583de50551c974e4e4ba049c336a3969106bf
parent16cc759ebd56fddd2a9d2437b810ced885ebda73
[llvm-readobj] - Validate the DT_STRSZ value to avoid crash.

It is possible to trigger a crash when a dynamic symbol has a
broken (too large) st_name and the DT_STRSZ is also broken.

We have the following code in the `Elf_Sym_Impl<ELFT>::getName`:

```
template <class ELFT>
Expected<StringRef> Elf_Sym_Impl<ELFT>::getName(StringRef StrTab) const {
  uint32_t Offset = this->st_name;
  if (Offset >= StrTab.size())
    return createStringError(object_error::parse_failed,
                             "st_name (0x%" PRIx32
                             ") is past the end of the string table"
                             " of size 0x%zx",
                             Offset, StrTab.size());
...
```

The problem is that `StrTab` here is a `ELFDumper::DynamicStringTab` member
which is not validated properly on initialization. So it is possible to bypass the
`if` even when the `st_name` is huge.

This patch fixes the issue.

Differential revision: https://reviews.llvm.org/D82201
llvm/test/tools/llvm-readobj/ELF/dyn-symbols.test
llvm/test/tools/llvm-readobj/ELF/dynamic-malformed.test
llvm/tools/llvm-readobj/ELFDumper.cpp