libctf: Bounds-check forward ctt_type before indexing pop[]
Fixes a stack buffer overflow in libctf by validating CTT types before array indexing.
A security vulnerability in libctf, which could lead to a stack buffer overflow, has been fixed. The issue arose from improperly validated ctt_type values in CTF_K_FORWARD records, which were used to index the pop[] array. The fix ensures that ctt_type is within the valid range before indexing, preventing out-of-bounds writes and returning an ECTF_CORRUPT error for invalid types.
In Details
The init_static_types_internal() function in libctf/ctf-open.c iterates through CTF type records. For CTF_K_FORWARD records, it uses the record's ctt_type field as an index into the pop[] array. This field, read directly from the object file, was not validated. A crafted input with a ctt_type exceeding CTF_K_MAX (63) would cause a stack buffer overflow when indexing pop[64] or higher. This commit adds a bounds check for ctt_type against CTF_K_MAX within the loop, returning ECTF_CORRUPT for invalid types, mirroring the handling in the subsequent pass.
- libctf
- A library for reading and writing Common Type Format (CTF) data, used for type information in DWARF debugging and other symbol table formats.
- CTF
- Common Type Format. A compact format for representing type information, often used in debugging and symbol rich executables.
- ctt_type
- CTF Type. Refers to a type code within the CTF format, indicating the kind of type being represented (e.g., struct, int, forward reference).
- CTF_K_FORWARD
- A specific kind of CTF type that acts as a placeholder or forward reference to another type definition.
- stack buffer overflow
- A type of memory corruption vulnerability where data written beyond the allocated buffer on the stack overwrites adjacent memory, potentially leading to program instability or arbitrary code execution.