[llvm-commits] [llvm] r149750 - /llvm/trunk/lib/Object/ELFObjectFile.cpp

[Dylan Noblesmith]

Author: nobled
Date: Fri Feb  3 20:41:39 2012
New Revision: 149750

URL: http://llvm.org/viewvc/llvm-project?rev=149750&view=rev
Log:
Object: avoid undefined behavior when bounds-checking

Don't form an out of bounds pointer just to test if it
would be out of bounds.

Also perform the same bounds checking for all the previous
mapped structures.

Modified:
    llvm/trunk/lib/Object/ELFObjectFile.cpp

Modified: llvm/trunk/lib/Object/ELFObjectFile.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Object/ELFObjectFile.cpp?rev=149750&r1=149749&r2=149750&view=diff
==============================================================================
--- llvm/trunk/lib/Object/ELFObjectFile.cpp (original)
+++ llvm/trunk/lib/Object/ELFObjectFile.cpp Fri Feb  3 20:41:39 2012
@@ -1173,25 +1173,36 @@
   , SectionHeaderTable(0)
   , dot_shstrtab_sec(0)
   , dot_strtab_sec(0) {
+
+  const uint64_t FileSize = Data->getBufferSize();
+
+  if (sizeof(Elf_Ehdr) > FileSize)
+    // FIXME: Proper error handling.
+    report_fatal_error("File too short!");
+
   Header = reinterpret_cast<const Elf_Ehdr *>(base());
 
   if (Header->e_shoff == 0)
     return;
 
+  const uint64_t SectionTableOffset = Header->e_shoff;
+
+  if (SectionTableOffset + sizeof(Elf_Shdr) > FileSize)
+    // FIXME: Proper error handling.
+    report_fatal_error("Section header table goes past end of file!");
+
+  // The getNumSections() call below depends on SectionHeaderTable being set.
   SectionHeaderTable =
-    reinterpret_cast<const Elf_Shdr *>(base() + Header->e_shoff);
-  uint64_t SectionTableSize = getNumSections() * Header->e_shentsize;
+    reinterpret_cast<const Elf_Shdr *>(base() + SectionTableOffset);
+  const uint64_t SectionTableSize = getNumSections() * Header->e_shentsize;
 
-  if ((const uint8_t *)SectionHeaderTable + SectionTableSize
-         > base() + Data->getBufferSize()) {
+  if (SectionTableOffset + SectionTableSize > FileSize)
     // FIXME: Proper error handling.
     report_fatal_error("Section table goes past end of file!");
-  }
-
 
   // To find the symbol tables we walk the section table to find SHT_SYMTAB.
   const Elf_Shdr* SymbolTableSectionHeaderIndex = 0;
-  const Elf_Shdr* sh = reinterpret_cast<const Elf_Shdr*>(SectionHeaderTable);
+  const Elf_Shdr* sh = SectionHeaderTable;
   for (uint64_t i = 0, e = getNumSections(); i != e; ++i) {
     if (sh->sh_type == ELF::SHT_SYMTAB_SHNDX) {
       if (SymbolTableSectionHeaderIndex)
@@ -1357,8 +1368,11 @@
 
 template<support::endianness target_endianness, bool is64Bits>
 uint64_t ELFObjectFile<target_endianness, is64Bits>::getNumSections() const {
-  if (Header->e_shnum == ELF::SHN_UNDEF)
+  assert(Header && "Header not initialized!");
+  if (Header->e_shnum == ELF::SHN_UNDEF) {
+    assert(SectionHeaderTable && "SectionHeaderTable not initialized!");
     return SectionHeaderTable->sh_size;
+  }
   return Header->e_shnum;
 }