libextractor

commit 7587479919bef5cfaddebc4f2ce5bbecfe0c76c2
parent ee66c7cb8e4a04b323e694ae483bde53397ee1d7
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 11:08:22 +0200

fix integer promotion issues

Diffstat:
M
src/plugins/elf_extractor.c
 | 
17
+++++++++++------

1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/src/plugins/elf_extractor.c b/src/plugins/elf_extractor.c
@@ -525,11 +525,16 @@ EXTRACTOR_elf_extract_method (struct EXTRACTOR_ExtractContext *ec)
     EXTRACTOR_common_cat_unpack (&data[EI_NIDENT],
                                  ELF_HEADER_SPECS[bo],
                                  ELF_HEADER_FIELDS (&ehdr));
-    if (ehdr.e_shoff + ehdr.e_shentsize * ehdr.e_shnum > max)
+    /* e_shentsize and e_shnum are 16 bit, so both promote to `int' and
+       their product overflows for large values; compute the bound in
+       64 bit unsigned arithmetic so that the check cannot be bypassed. */
+    if ((uint64_t) ehdr.e_shoff
+        + (uint64_t) ehdr.e_shentsize * (uint64_t) ehdr.e_shnum > max)
       return;              /* invalid offsets... */
     if (ehdr.e_shentsize < ELF_SECTION_SIZE)
       return;              /* huh? */
-    if (ehdr.e_phoff + ehdr.e_phensize * ehdr.e_phnum > max)
+    if ((uint64_t) ehdr.e_phoff
+        + (uint64_t) ehdr.e_phensize * (uint64_t) ehdr.e_phnum > max)
       return;
     ret = 0;
     bo = get_byte_order (data[EI_DATA]);
@@ -541,11 +546,11 @@ EXTRACTOR_elf_extract_method (struct EXTRACTOR_ExtractContext *ec)
     EXTRACTOR_common_cat_unpack (&data[EI_NIDENT],
                                  ELF64_HEADER_SPECS[bo],
                                  ELF64_HEADER_FIELDS (&ehdr64));
-    if (ehdr64.e_shoff + ((uint32_t) ehdr64.e_shentsize * ehdr64.e_shnum) >
-        max)
+    if ((uint64_t) ehdr64.e_shoff
+        + (uint64_t) ehdr64.e_shentsize * (uint64_t) ehdr64.e_shnum > max)
       return;              /* invalid offsets... */
-    if (ehdr64.e_phoff + ((uint32_t) ehdr64.e_phensize * ehdr64.e_phnum) >
-        max)
+    if ((uint64_t) ehdr64.e_phoff
+        + (uint64_t) ehdr64.e_phensize * (uint64_t) ehdr64.e_phnum > max)
       return;
     bo = get_byte_order (data[EI_DATA]);
     ret = 1;