Skip to content

reject invalid symbol table entry size in FindSymbol#2103

Open
nabhan06 wants to merge 2 commits into
abseil:masterfrom
nabhan06:symbolize-symtab-entsize
Open

reject invalid symbol table entry size in FindSymbol#2103
nabhan06 wants to merge 2 commits into
abseil:masterfrom
nabhan06:symbolize-symtab-entsize

Conversation

@nabhan06

@nabhan06 nabhan06 commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Unchecked symbol-table entry size in FindSymbol
symtab->sh_entsize is read verbatim from the object file and used as the divisor for num_symbols and as the per-entry read stride. A crafted ELF whose SHT_SYMTAB/SHT_DYNSYM header carries an entry size of zero divides by zero here; any other value that differs from sizeof(ElfW(Sym)) slides the fixed-size symbol reads off the real entries. Added the same exact-size check the section-header paths already apply to e_shentsize, so a malformed table is skipped instead of trusted.

@mkruskal-google mkruskal-google self-requested a review July 10, 2026 06:02
@mkruskal-google

Copy link
Copy Markdown
Contributor

Can you add a test case that demonstrates this bug (and fails without the fix)?

@mkruskal-google mkruskal-google left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requesting changes*

@nabhan06

Copy link
Copy Markdown
Contributor Author

Added one in symbolize_test.cc (InvalidSymtabEntSizeDoesNotCrash). It builds a minimal ELF whose SHT_SYMTAB header has sh_entsize == 0, maps an executable page, and points the symbolizer at that file via a mapping hint so FindSymbol actually runs over it. Without the guard the num_symbols = sh_size / sh_entsize divide-by-zero SIGFPEs during symbolization; with it the malformed table is skipped and the address just fails to resolve. Reused the same RegisterFileMappingHint approach as SymbolizeWithMultipleMaps, and it's guarded to the ELF symbolizer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants