<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Yes, that's what happens to all 3 fields. I already fixed LLDB, Pavel reviewed the change.</p>
<p><br>
</p>
<div id="Signature">
<p>Sent from <a href="http://aka.ms/weboutlook" id="LPNoLP">Outlook</a><br>
</p>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Greg Clayton <gclayton@apple.com><br>
<b>Sent:</b> Thursday, February 2, 2017 2:31 PM<br>
<b>To:</b> Eugene Birukov<br>
<b>Cc:</b> Pavel Labath; LLDB<br>
<b>Subject:</b> Re: [lldb-dev] ELF header does not hold big modules</font>
<div> </div>
</div>
<div>Found this on the web:
<div class=""><br class="">
</div>
<div class="">
<pre class="">e_shnum
This member holds the number of entries in the section header
table. Thus the product of e_shentsize and e_shnum gives the section
header table's size in bytes. If a file has no section header table,
e_shnum holds the value zero.
If the number of sections is greater than or equal to SHN_LORESERVE
(0xff00), this member has the value zero and the actual number of
section header table entries is contained in the sh_size field of
the section header at index 0. (Otherwise, the sh_size member of the
initial entry contains 0.)
</pre>
<div class=""><br class="">
</div>
<div class="">See the second paragraph. I am guessing the same thing would need to happen for program headers? I would check the various ELF file parsers in LLVM and see if they handle this correctly?</div>
<div class=""><br class="">
</div>
<div class="">Greg</div>
<div class=""><br class="">
</div>
<div>
<blockquote type="cite" class="">
<div class="">On Jan 23, 2017, at 3:26 PM, Eugene Birukov via lldb-dev <<a href="mailto:lldb-dev@lists.llvm.org" class="">lldb-dev@lists.llvm.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div id="divtagdefaultwrapper" dir="ltr" class="" style="font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<div class="" style="margin-top:0px; margin-bottom:0px">> <span class="" style="font-family:Calibri,Arial,Helvetica,sans-serif,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:13.3333px">By "all"
I presume you mean "all fields that refer </span><span class="" style="font-family:Calibri,Arial,Helvetica,sans-serif,'Apple Color Emoji','Segoe UI Emoji',NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size:13.3333px">to section counts
or indexes".</span></div>
<div class="" style="margin-top:0px; margin-bottom:0px"><br class="">
</div>
<div class="" style="margin-top:0px; margin-bottom:0px">Correct. I mean exactly 3 fields: e_phnum, e_shnum, and e_shstrndx that could be redirected to section #0.</div>
<div class="" style="margin-top:0px; margin-bottom:0px"><br class="">
</div>
<div id="Signature" class="">
<div class="" style="margin-top:0px; margin-bottom:0px">Sent from<span class="Apple-converted-space"> </span><a href="http://aka.ms/weboutlook" id="LPNoLP" class="">Outlook</a><br class="">
</div>
</div>
<br class="">
<br class="">
<div class="" style="">
<div class="">
<hr tabindex="-1" class="" style="display:inline-block; width:1982.53125px">
<div id="x_divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" class="" style="font-size:11pt"><b class="">From:</b><span class="Apple-converted-space"> </span>Pavel Labath <<a href="mailto:labath@google.com" class="">labath@google.com</a>><br class="">
<b class="">Sent:</b><span class="Apple-converted-space"> </span>Monday, January 23, 2017 2:04 AM<br class="">
<b class="">To:</b><span class="Apple-converted-space"> </span>Eugene Birukov<br class="">
<b class="">Cc:</b><span class="Apple-converted-space"> </span>LLDB<br class="">
<b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: ELF header does not hold big modules</font>
<div class=""> </div>
</div>
</div>
<font size="2" class=""><span class="" style="font-size:10pt">
<div class="PlainText">Hello Eugene,<br class="">
<br class="">
On 21 January 2017 at 00:42, Eugene Birukov <<a href="mailto:eugenebi@hotmail.com" class="">eugenebi@hotmail.com</a>> wrote:<br class="">
> Hello,<br class="">
><br class="">
><br class="">
> I have a core dump that LLDB cannot open because it contains more than 64K<br class="">
> sections. The "readelf" utility gives me the output in the end of this<br class="">
> message. It seems that the actual number of program headers and the index of<br class="">
> string table section are written into very first section since they do not<br class="">
> fit in 16 bits.<br class="">
><br class="">
><br class="">
> The "natural" way to deal with this problem would be to change the types of<br class="">
> fields in ELFHeader struct from 16 to 32 bits (or should I go all the way<br class="">
> and do it 64? in case the core dump is bigger than 4GB...) and deal with<br class="">
> the problem in a single place where we parse the header - the<br class="">
> ELFHeader::Parse().<br class="">
><br class="">
><br class="">
> Objections? Suggestions? Advices?<br class="">
<br class="">
Sounds like a plan. By "all" I presume you mean "all fields that refer<br class="">
to section counts or indexes". I don't see a reason the change the<br class="">
size of the e.g. e_type field. I think going 32 bit will be enough,<br class="">
particularly as the "fallback" field you are reading this from is only<br class="">
32 bit wide anyway, and so you would still have to touch this if we<br class="">
ever cross that boundary. (And we are really talking about 4 billion<br class="">
sections, not a 4GB core file, right?)<br class="">
<br class="">
<br class="">
> Hmm... I am not sure that the DataExtractor we pass down there would let me<br class="">
> read that much past in the file - I have impression that we give only first<br class="">
> 512 bytes there, but I might be mistaken...<br class="">
<br class="">
The reason we initially read only the first few bytes of the file, is<br class="">
to be able to make a quick decision as to whether this is likely to be<br class="">
a valid elf file (see call to ObjectFileELF::MagicBytesMatch in<br class="">
GetModuleSpecifications). After that, we extend the buffer to the<br class="">
whole file. It looks like this currently happens before parsing the<br class="">
ELF header, but I don't see a reason why it would have to stay that<br class="">
way.<br class="">
<br class="">
cheers,<br class="">
pavel<br class="">
</div>
</span></font></div>
</div>
<span class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important">_______________________________________________</span><br class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<span class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important">lldb-dev
mailing list</span><br class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<span class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important"><a href="mailto:lldb-dev@lists.llvm.org" class="">lldb-dev@lists.llvm.org</a></span><br class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<span class="" style="font-family:Menlo-Regular; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important"><a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev" class="">http://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev</a></span></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</body>
</html>