RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 12:48:10 +00:00
Code Issues Activity Actions

LibELF+Kernel: Validate program headers in Image::parse

Browse source 
This should catch more malformed ELF files earlier than simply
checking the ELF header alone. Also change the API of
validate_program_headers to take the interpreter_path by pointer. This
makes it less awkward to call when we don't care about the interpreter,
and just want the validation.
This commit is contained in:
Andrew Kaster 2020-11-30 23:21:55 -07:00 • committed by Andreas Kling
parent 8297698a3a
commit 3f808b0dda
5 changed files with 30 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

31
Libraries/LibELF/Validation.cpp
View file

@ -172,13 +172,14 @@ bool validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size, bool ve
return true;
}
bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8* buffer, size_t buffer_size, String& interpreter_path)
bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, const u8* buffer, size_t buffer_size, String* interpreter_path, bool verbose)
{
// Can we actually parse all the program headers in the given buffer?
size_t end_of_last_program_header = elf_header.e_phoff + (elf_header.e_phnum * elf_header.e_phentsize);
if (end_of_last_program_header > buffer_size) {
dbgprintf("Unable to parse program headers from buffer, buffer too small! Buffer size: %zu, End of program headers %zu\n",
buffer_size, end_of_last_program_header);
if (verbose)
dbgprintf("Unable to parse program headers from buffer, buffer too small! Buffer size: %zu, End of program headers %zu\n",
buffer_size, end_of_last_program_header);
return false;
}
@ -195,15 +196,18 @@ bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8
switch (program_header.p_type) {
case PT_INTERP:
if (ET_DYN != elf_header.e_type) {
dbgprintf("Found PT_INTERP header (%zu) in non-DYN ELF object! What? We can't handle this!\n", header_index);
if (verbose)
dbgprintf("Found PT_INTERP header (%zu) in non-DYN ELF object! What? We can't handle this!\n", header_index);
return false;
}
// We checked above that file_size was >= buffer size. We only care about buffer size anyway, we're trying to read this!
if (program_header.p_offset + program_header.p_filesz > buffer_size) {
dbgprintf("Found PT_INTERP header (%zu), but the .interp section was not within our buffer :( Your program will not be loaded today.\n", header_index);
if (verbose)
dbgprintf("Found PT_INTERP header (%zu), but the .interp section was not within our buffer :( Your program will not be loaded today.\n", header_index);
return false;
}
interpreter_path = String((const char*)&buffer[program_header.p_offset], program_header.p_filesz - 1);
if (interpreter_path)
*interpreter_path = String((const char*)&buffer[program_header.p_offset], program_header.p_filesz - 1);
break;
case PT_LOAD:
case PT_DYNAMIC:
@ -211,28 +215,33 @@ bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8
case PT_PHDR:
case PT_TLS:
if (program_header.p_offset + program_header.p_filesz > file_size) {
dbgprintf("SHENANIGANS! Program header %zu segment leaks beyond end of file!\n", header_index);
if (verbose)
dbgprintf("SHENANIGANS! Program header %zu segment leaks beyond end of file!\n", header_index);
return false;
}
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
dbgprintf("SHENANIGANS! Program header %zu segment is marked write and execute\n", header_index);
if (verbose)
dbgprintf("SHENANIGANS! Program header %zu segment is marked write and execute\n", header_index);
return false;
}
break;
case PT_GNU_STACK:
if (program_header.p_flags & PF_X) {
dbgprintf("Possible shenanigans! Validating an ELF with executable stack.\n");
if (verbose)
dbgprintf("Possible shenanigans! Validating an ELF with executable stack.\n");
}
break;
case PT_GNU_RELRO:
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
dbgprintf("SHENANIGANS! Program header %zu segment is marked write and execute\n", header_index);
if (verbose)
dbgprintf("SHENANIGANS! Program header %zu segment is marked write and execute\n", header_index);
return false;
}
break;
default:
// Not handling other program header types in other code so... let's not surprise them
dbgprintf("Found program header (%zu) of unrecognized type %x!\n", header_index, program_header.p_type);
if (verbose)
dbgprintf("Found program header (%zu) of unrecognized type %x!\n", header_index, program_header.p_type);
return false;
}
}