Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: Unlimited recursion when parsing linked sections #369

Closed
pd-fkie opened this issue Aug 30, 2021 · 3 comments
Closed

Bug: Unlimited recursion when parsing linked sections #369

pd-fkie opened this issue Aug 30, 2021 · 3 comments

Comments

@pd-fkie
Copy link

pd-fkie commented Aug 30, 2021

When the class ELFFile parses sections that are linked via sh_link it doesn't check for any loops
in the linked list.
According to Oracles Linker and Libraries Guide a linked list of sections can be terminated by
a section that points to itself if sh_flags contains the flag SHF_ORDERED.
In the current state of pyelftools however such an endless loop would result in a RecursionError exception.

The following ELF file can trigger the exception when parsed with the current version of pyelftools:
crash-d08fc9a817c40b3c241a163d9101ab425fe31db5
As the name indicates this bug was found through fuzzing and thus the crash file does not adhere to the ELF standard however it would be possible to create a valid ELF file that triggers the same exception.

@pd-fkie pd-fkie changed the title Bug: Unlimited recursion when parsing sections Bug: Unlimited recursion when parsing linked sections Aug 30, 2021
@eliben
Copy link
Owner

eliben commented Aug 31, 2021

Thanks for the report. PRs to fix this are welcome.

@sevaa
Copy link
Contributor

sevaa commented Apr 16, 2024

To elaborate, the problem in the linked file is that section 0 has type SHT_HASH and has 0 as sh_link (e. g. points at itself). ELFFile.get_section() for section 0 tries to build a ELFHashSection, follows the link, which calls get_section() with 0 and so on.

@sevaa
Copy link
Contributor

sevaa commented Apr 17, 2024

@pd-fkie Addressed in #522 by validating which section types can link to which.

@pd-fkie pd-fkie closed this as completed Apr 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants