PR 34327 Out of bounds accesses in reloc special functions
Fixes out-of-bounds access in relocation functions and corrects a long-standing bug in the mmix howto table.
This patch addresses out-of-bounds read accesses in relocation functions across various ELF targets by implementing proper sanity checks for relocation offsets. It also corrects an issue in the mmix howto table that has persisted since its initial commit, specifically concerning the size and interpretation of the R_MMIX_BASE_PLUS_OFFSET field, which was incorrectly defined as an eight-byte field.
- proposer
Proposes fixes for out-of-bounds accesses in relocation functions and corrects an error in the mmix howto table.
“As per the PR, s12z lacked any reloc offset sanity checking, the others all just checked that the offset started within the section rather than checking the field was contained in the section. Using the proper check for mmix exposed a problem in the howto table, present since the initial mmix commit. The R_MMIX_BASE_PLUS_OFFSET field is actually two bytes, located at the reloc address. Making…”
- reviewer
Agrees with the proposed fix for the mmix howto table and notes that the problem has existed since the initial commit.
“Looks like it; R_MMIX_BASE_PLUS_OFFSET was there originally, but most of the implementation came later.”
- proposer
Clarifies that the overflow reporting was handled by `complain_on_overflow` and that the change to `complain_overflow_dont` is correct, despite potential initial confusion.
“I meant, presu”
Technical Tradeoffs
- Enforces stricter bounds checking, potentially rejecting malformed object files that may have previously been processed partially.
- Corrects a historical inaccuracy in a specific architecture's relocation handling.
In Details
This patch series addresses security vulnerabilities and correctness issues in binutils' BFD library related to ELF relocations. Specifically, it fixes several functions that perform out-of-bounds reads by not properly checking if the relocation offset falls within the bounds of the target section. An additional fix targets a long-standing bug in the mmix ELF target's howto table, correcting the size and overflow reporting for the R_MMIX_BASE_PLUS_OFFSET relocation.
- relocation
- A directive that describes how to modify code or data when an object file is linked. Relocations typically specify an address and the type of modification needed, such as patching in an offset or a symbol address.
- ELF
- Executable and Linkable Format, a standard file format for executables, object code, shared libraries, and core dumps on many Unix-like systems.
- howto table
- A data structure within BFD that describes how to perform specific relocation types for a given architecture. It maps relocation types (e.g., R_MMIX_BASE_PLUS_OFFSET) to operations and checks.
- out-of-bounds access
- An error where a program attempts to read from or write to a memory location that is outside the allocated bounds of an array or buffer, potentially leading to data corruption or crashes.