[PATCH] readelf: Fix division by zero in handle a relocation sections

Maks Mishin maks.mishinfz@gmail.com
Fri Mar 29 21:23:31 GMT 2024


Variable 'sh_entsize', whose possible value set allows a zero value
by calling function 'gelf_fsize', is used as a denominator
in calculation of 'nentries' variable.

Found by RASU JSC.

Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com>
---
 src/readelf.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/readelf.c b/src/readelf.c
index 0e931184..6701f5cf 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -2086,6 +2086,12 @@ handle_relocs_rel (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT);
+
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_rel() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
@@ -2275,6 +2281,12 @@ handle_relocs_rela (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT);
+
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_rela() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
@@ -2469,6 +2481,12 @@ handle_relocs_relr (Ebl *ebl, Dwfl_Module *mod, Elf_Scn *scn, GElf_Shdr *shdr)
 {
   int class = gelf_getclass (ebl->elf);
   size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELR, 1, EV_CURRENT);
+  
+  if (sh_entsize == 0) {
+	printf (_("division by zero in handle_relocs_relr() function"));
+	return;
+  }
+
   int nentries = shdr->sh_size / sh_entsize;
 
   /* Get the data of the section.  */
-- 
2.30.2



More information about the Elfutils-devel mailing list