[llvm] 2ad0ef6 - [llvm-readelf] - Do not try to read past the end of the file when dumping the the SHT_GNU_HASH.

[Georgii Rymar via llvm-commits]

Author: Georgii Rymar
Date: 2020-06-04T12:00:44+03:00
New Revision: 2ad0ef6ef19dd1678e05b6d219ea0fdd4853bb64

URL: https://github.com/llvm/llvm-project/commit/2ad0ef6ef19dd1678e05b6d219ea0fdd4853bb64
DIFF: https://github.com/llvm/llvm-project/commit/2ad0ef6ef19dd1678e05b6d219ea0fdd4853bb64.diff

LOG: [llvm-readelf] - Do not try to read past the end of the file when dumping the the SHT_GNU_HASH.

We have unobvious issue in the condition that is used to check
that we do not read past the EOF.

The problem is that the result of "GnuHashTable->nbuckets * 4" expression is uint32.
Because of that it was still possible to overflow it and pass the check.

There was no such problem with the "GnuHashTable->maskwords * sizeof(typename ELFT::Off)"
condition, because of `sizeof` on the right (which gives 64-bits value on x64),
but I've added an explicit conversion to 64-bit value for `GnuHashTable->maskwords` too.

Differential revision: https://reviews.llvm.org/D81103

Added: 
    

Modified: 
    llvm/test/tools/llvm-readobj/ELF/hash-histogram.test
    llvm/tools/llvm-readobj/ELFDumper.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/test/tools/llvm-readobj/ELF/hash-histogram.test b/llvm/test/tools/llvm-readobj/ELF/hash-histogram.test
index 4ec772a18f82..a9d2455d5f91 100644
--- a/llvm/test/tools/llvm-readobj/ELF/hash-histogram.test
+++ b/llvm/test/tools/llvm-readobj/ELF/hash-histogram.test
@@ -271,7 +271,7 @@ ProgramHeaders:
 
 ## Case A: the 'nbuckets' field is set so that the GNU hash table goes past the end of the file.
 ##         The value of 1 for the NBUCKETS is no-op.
-# RUN: yaml2obj --docnum=6 -D MASKWORDS=4294967295 -D NBUCKETS=1 %s -o %t7
+# RUN: yaml2obj --docnum=6 -D MASKWORDS=0x80000000 -D NBUCKETS=1 %s -o %t7
 # RUN: llvm-readelf --elf-hash-histogram %t7 2>&1 | \
 # RUN:   FileCheck %s -DFILE=%t7 --check-prefix=ERR5 --implicit-check-not="Histogram"
 
@@ -279,7 +279,7 @@ ProgramHeaders:
 
 ## Case B: the 'maskwords' field is set so that the GNU hash table goes past the end of the file.
 ##         The value of 1 for the MASKWORDS is no-op.
-# RUN: yaml2obj --docnum=6 -D MASKWORDS=1 -D NBUCKETS=4294967295 %s -o %t8
+# RUN: yaml2obj --docnum=6 -D MASKWORDS=1 -D NBUCKETS=0x80000000 %s -o %t8
 # RUN: llvm-readelf --elf-hash-histogram %t8 2>&1 | \
 # RUN:   FileCheck %s -DFILE=%t8 --check-prefix=ERR5 --implicit-check-not="Histogram"
 

diff  --git a/llvm/tools/llvm-readobj/ELFDumper.cpp b/llvm/tools/llvm-readobj/ELFDumper.cpp
index 861149ab9ca7..6c197cf0239c 100644
--- a/llvm/tools/llvm-readobj/ELFDumper.cpp
+++ b/llvm/tools/llvm-readobj/ELFDumper.cpp
@@ -2681,8 +2681,8 @@ static Error checkGNUHashTable(const ELFFile<ELFT> *Obj,
   uint64_t TableOffset = TableData - Obj->base();
   if (IsHeaderValid)
     *IsHeaderValid = TableOffset + /*Header size:*/ 16 < Obj->getBufSize();
-  if (TableOffset + 16 + GnuHashTable->nbuckets * 4 +
-          GnuHashTable->maskwords * sizeof(typename ELFT::Off) >=
+  if (TableOffset + 16 + (uint64_t)GnuHashTable->nbuckets * 4 +
+          (uint64_t)GnuHashTable->maskwords * sizeof(typename ELFT::Off) >=
       Obj->getBufSize())
     return createError("unable to dump the SHT_GNU_HASH "
                        "section at 0x" +