From patchwork Thu Aug 27 22:41:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142350 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id CE2CB4BA9003 for ; Thu, 27 Aug 2026 22:44:43 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CE2CB4BA9003 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=nxA35EEZ X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) by sourceware.org (Postfix) with ESMTPS id 762774BA9012 for ; Thu, 27 Aug 2026 22:42:18 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 762774BA9012 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 762774BA9012 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::52b ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870538; cv=none; b=fw00NgIX/0ZzDFEM1JzfNhWJM5zmgO0JDAApn9W3CGPRfAigu9f0JXJLQPjdsQcZw5rl8/TiZ3iSXaFBozM+/O1SCyfrLlrDTQm7Nw6hgFLSxJN9A2yvWboVdDwKKa9svvw69YQYU6k6zy4UIbGxZM7TbdDyEuIfQUhaaksSwYk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870538; c=relaxed/simple; bh=DdbP/4cW/CaKeMygUUvZGGgTmTklXE5wIyaugfLAuC8=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=yEnHZCMgqnLy8nuzky2jTFq2qped65EgpSRqPW31qxCgZKrMu0BGjTFyq8FGtJoXZaAJ9uL0TbAVCvFEQSnmmbc2NFtWVu+KF7lr2sO4iVk9eIJeTfw9i3F1bjG//97spXUU/0B+RfslQb9V2TTcTNvDljPFoUtKzRnDTGZnIYM= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=nxA35EEZ DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 762774BA9012 Received: by mail-pg1-x52b.google.com with SMTP id 41be03b00d2f7-cc147d86bebso423067a12.0 for ; Thu, 27 Aug 2026 15:42:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870537; x=1788475337; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iYsZLRmjnwSYh1GlxKmkCBHneM7KRJ9TZxDu1eji0ag=; b=nxA35EEZkX5w+VuO9FtCzBpbOZHOPgag0N2b8/j1i89JBPeGL83KCEaXYgBaYaAdd+ kBcDUjRzwaTg5iiFawE1CZhpPnylzbLLEjSN4tKiDDAfpAjVNNj4CDRYYdKTtZ1Uqs1a mlc31K/gHPrOYapJLEFYO9fp7LAkzpUTP0U7WfXHgIYhHzoOZyqAthc22M1UTo8j3HgK PpkGUCgtolOxxw3Nn/j0S2c96UpgR5hnMn61Z4NvM9fBwMh5bs8p4vMB+qaT2NJ4TTEH cV9+ftYn0/UlNAWdYZKtdfQraRWDkFlgHkt7zkNQmNXj41PpuhSZdNgoJ0wO1lXvBCj6 2wuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870537; x=1788475337; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iYsZLRmjnwSYh1GlxKmkCBHneM7KRJ9TZxDu1eji0ag=; b=YHiQVSLjBtzuD59L2vL54/EY0z5c1//gH1ZLrmdvbibR5xHUuYFdC4VkfKmrUnAlaS ykGA8T9lN2zmd8PNrR7NSLlD/D7wrfWngP2CPWW6KmbgsY8Fr/lWkzm9lG+m7FGd+wH9 BWvNUpRCtS3UyJKgJrdBHxk/a9xfot6w/JxKfreJmeWKKRZCw+RmdKJ8Mtv+P9KYfI/5 jpwkWLu3oMUiRtFTgqxkQA4njF6nggN22EwbIUYUsuYC/GYI/QTSfcZvLJDrND+4aKs1 dYKEXosjZqe9FGutzLgjdET+HMYJHTKnMXVA/Ee1rRbGo4cFewNNtAGSC1U4IWfyvbAb 7aPQ== X-Gm-Message-State: AFuF++nY4yw8iOaK5oNSdSN2ySQfJWKaU1+B/KE03w+ey6WMhQm1Mf/a QXZofckGO/tlFK7UvlSGVCo1xOlXH6UJHfji8XJ2mIcZrN2AskcY30us+LF7bg== X-Gm-Gg: AR+sD10eUgKosDLYP0xewNw3j3uwcoTXN4BLpyKZIhEnyAlW7VtcTWnbMLGY/2WL8FS aDl+VuKBEsxW202/frDbl8kersaQiYzGHVoo1FPEPuR8LvpPzU12zFDSQ+9SxYI2wV33QwZ7Bzw zEdsHEerDDLFCruPnN2TptEIDdemgB37tCEmtiKJrsLCO/jYNdA9kbOJ3W5iUJ4rSjvcUm3yzcJ uy1jqz64dBQDpyllpVxDJ1HUAjFUaN6x+wxElM8ppCpHYvqe6EZR0I5JK76mlcXLBNIcAZlthx4 pWk8E3YZ6+CWM631nC/q7ncy6Hl8SDtbPojohkwIBujOCbGXFUw2jXoF3qk/Q1/4Q2byE8qLRwC XYSeBjEaixa7a7i2XlraPwCgvlowXWvsoMJIoSeBrQY/FJo1B1Zpa9i4uX6x36OXpFvhxEtvfXx 9PNPVr0fAoWHFelDf+OtIPf6qj31xvoUWhtpwmzs7YXA== X-Received: by 2002:a17:90b:1fcc:b0:38f:de94:bf34 with SMTP id 98e67ed59e1d1-396d0f8115cmr2438925a91.10.1787870537347; Thu, 27 Aug 2026 15:42:17 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:16 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 01/10] libsframe: null check arg before writing to in sframe_encoder_write Date: Thu, 27 Aug 2026 15:41:37 -0700 Message-ID: <20260827224146.3391610-2-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Check for encoder_size == NULL before writing to it. Reviewed-by: Jens Remus --- libsframe/sframe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index cd6bb3022db..011884c0768 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -2708,7 +2708,8 @@ sframe_encoder_write (sframe_encoder_ctx *ectx, size_t *encoded_size, /* Initialize the encoded_size to zero. This makes it simpler to just return from the function in case of failure. Free'ing up of ectx->sfe_data is the responsibility of the caller. */ - *encoded_size = 0; + if (encoded_size != NULL) + *encoded_size = 0; if (ectx == NULL || encoded_size == NULL || errp == NULL) return sframe_ret_set_errno (errp, SFRAME_ERR_INVAL); From patchwork Thu Aug 27 22:41:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142351 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 07D7A4B9DB49 for ; Thu, 27 Aug 2026 22:45:01 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 07D7A4B9DB49 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=pQ4JC6fl X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by sourceware.org (Postfix) with ESMTPS id C0FBB4BA903D for ; Thu, 27 Aug 2026 22:42:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org C0FBB4BA903D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org C0FBB4BA903D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1036 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870550; cv=none; b=QjvsOcRcIjL4btjG+Kazk44/PTn87yaMRNXvwpgUryVnomQj7Wn0ZcuZWxAzMiULW6gAwW4YmLHnn9QrxWrFBnzqhNIJxNhQiaHmbmKhui3EKv1uQEF9plAutOClTeA6cW5AorDaEhZg00yQA0bzedzXP3Wr6oZRS9GGJpfLz0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870550; c=relaxed/simple; bh=is4aALrpSLisAJwnZfLgoEE4P1itXCeq7ZWjJpjTyRw=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=fj6wZHVX2ErByDTdTDHTJs+KLkoKR/Dl+zhOvn/KaeXHyW0gSyZP8+5yshXr0WWuBT+4tnrj5KJU8amMDTAfK69OdTpbXSigkZZnh51+57hgPnsLp1oaqoutcM5Ho3wbHk2YkxY0rL6vmiAZnfi/qHhNCns/z7dyYDrAinhdhCg= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=pQ4JC6fl DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C0FBB4BA903D Received: by mail-pj1-x1036.google.com with SMTP id 98e67ed59e1d1-38759bcd877so289455a91.2 for ; Thu, 27 Aug 2026 15:42:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870539; x=1788475339; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Qu1EbriJTIR0RW1nZfczC2RqM9tvnHpE35eZrXkCLm8=; b=pQ4JC6fllC7qOZBo0S/WoV/eKCkumATaERRvezwdDLc/o5l40dIZZ9KWruoDQ1I8dr ZpoB2k0EHpEBdfxO0+Utj8tpIKEG4ZOVP/84/UFLZBJdql6lZujxU6oqWbYRQqTKOvFu lp6fS7amqheYRM2mW8GTCqO8Am7mCX3p1krxBU+dGD60XDV4+lBd8rco0JOZNpd++RBx 5rEPOkaKdGaoHMERrBDQnmPVVETSGtKars2gGtQzdeMHgwYawb2gxUyIfhiCTfK9KTID OgOcEgsprQRIhZoLy40cltCzQ7SLCQgOSULWiF4rYt1wf2pN9pE3RYHVLY6lUZFzTteQ ARLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870539; x=1788475339; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Qu1EbriJTIR0RW1nZfczC2RqM9tvnHpE35eZrXkCLm8=; b=gaASahltP0moMWmeL+7bif6oyb2h7xvV/6qbLxZS6i4CDM9g2L52HVC6CoPBhpW/kO /mTFd68DI3IW1hr5bvDdLqP0zzGSkJdPubC18yq7g1mCHW+gaIuc0TZwGf7tTq4kYqOM MVUHQZcxg8hKO3lsBoUFRsMn6HLjZwf/nee35xnD67lotUeID2tI2QWDlO/vV5/+ok0Z syLDhle4enfgxNoBSR8wDtNQbUAMZyjUvwjGc6j3nCHlrPHu8oqXd/cEhDSnEaPNEHWr rtG4Bb/XAt3tPXR/l7y0O31+cmsk9tHQhdnCV4oyAi87hbIbkvbAFsfbRd04peunRvc6 M18w== X-Gm-Message-State: AFuF++ngfRZgDQWViqA5gok9KxLAEj/H3FAFuwLQxdzaivOVP7YJ1G9v 8qh4PpgNg1yDUT1Kp3HKGKtg9CHNTw2zvqZLDda1YZO+gk4xnN6pcLhqQ8ss/w== X-Gm-Gg: AR+sD10RYXW7mWVOBt2OYlfCcp/CEW9tGHKct1WnnssWmVs4nhgLNresxwSVNAaEOCj eUlB1COjijPmaSDE74MxJMdpVuCsscGZ+TZgFYhDkfk/zdGTKSo5zGrs3zYX7ICIhJZC1u6+/Ou 5DpsjgTh/7ZOOjyUbw033tczyPaumOKcHNcK3R52N60Xi8BSdOqlxg/IdRS/zsKJwmSr99dmE+Q GWEtNco4MWzMpJPEiTD0etn3hXIOgOZEqFdlEGVVBZVPP+u+019PmadJKZYcaa8JatP8nLzP1nf O0Vwez+CjC0sdRyngn1Bz3AYlqjEu82Irhx1viONUUOZz7gVPX1Gw2vWBENDILaWu/Sw/ReqaZE bNLX+OyVGg64ELgwMqeYZjllWbxvsqGkR+IJi0sNqlPAKBj9epNJe0kqjmyFn1dXlFc79qXcBsC QEwiD08RS/66GdwIYGismwHK8At3C3r29nZ4FPhemzmxo66EJrSFqZ X-Received: by 2002:a17:90b:2f0f:b0:380:540:d499 with SMTP id 98e67ed59e1d1-396d0ed0023mr5056564a91.6.1787870538663; Thu, 27 Aug 2026 15:42:18 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:18 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 02/10] libsframe: guard against malformed rep_block_size Date: Thu, 27 Aug 2026 15:41:38 -0700 Message-ID: <20260827224146.3391610-3-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org From: Indu Bhagat When checking for an applicable FRE, guard against invalid data in rep_block_size, lest there be an arithmetic exception caused by division by zero. Similar code was flagged by Sashiko in the stacktracer patches for Linux kernel earlier. Reviewed-by: Jens Remus --- libsframe/sframe.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 011884c0768..712dd0fdb68 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -600,7 +600,12 @@ sframe_fre_check_range_p (const sframe_decoder_ctx *dctx, uint32_t func_idx, /* For SFrame FDEs encoding information for repetitive pattern of insns, masking with the rep_block_size is necessary to find the matching FRE. */ if (mask_p) - pc_offset = pc_offset % rep_block_size; + { + /* Treat a zero-sized repeat block as malformed input. */ + if (rep_block_size == 0) + return false; + pc_offset = pc_offset % rep_block_size; + } return (start_ip_offset <= pc_offset) && (end_ip_offset >= pc_offset); } From patchwork Thu Aug 27 22:41:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142346 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 4EFE14BA23EF for ; Thu, 27 Aug 2026 22:42:53 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4EFE14BA23EF Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=qtChO17y X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102d.google.com (mail-pj1-x102d.google.com [IPv6:2607:f8b0:4864:20::102d]) by sourceware.org (Postfix) with ESMTPS id 7A1874BA798B for ; Thu, 27 Aug 2026 22:42:20 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7A1874BA798B Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7A1874BA798B Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102d ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870541; cv=none; b=p6wIsvv5IOyq+NHHl7zrPY6/OxkllQhP7S2wmyv2twdWM1m5nKQMYmcIgbwUrx9nzNQY51w1qhqLP3HZAWDQXkRH/GGa4jgwTzzDG3CNIofDTxE94APEJa9wA0EuCDFuw87XdGEzzGWt6hWt6cZiPy9KC4uqa8EfUjVEwfQ2pQM= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870541; c=relaxed/simple; bh=L19fC61EwxcqJComBd4NpxbhPOVkide28t/oQN8OL/c=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=d9t6kNZH4HttxXAd9S+INKI9qZS1IeuVZ3prh29Vb7+ye7D6Oyr0I4hhCQZq+xM/ZFPp20N4jGB8dqrf99IVU9IYfyBuqFBsn9Jy+O2s7lSR01NF/e70iC7iIQlF47rIfPVVlAB6p6SIQcDJJa58kkOdPQJGbuW2m4f6Kl/queg= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=qtChO17y DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7A1874BA798B Received: by mail-pj1-x102d.google.com with SMTP id 98e67ed59e1d1-38e58034d05so496744a91.2 for ; Thu, 27 Aug 2026 15:42:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870539; x=1788475339; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AclrZnmx1dt+bWgdQx18LHB9BqExVnIlYnogkUFLNoA=; b=qtChO17yxPj/zjVkspvwDQoW1SyeLDnf19k0n1dQjpjEaCXsXc0lJDCQDo7B//s1AA MMOZ1BzBixfVF9v4FsXDmLng4aauCdzuoXEVxwinWMXcPMzUYdaFeAo0M5b/WAf1iz46 PM9WlT5SsGL4pfbsAUF7rVJI5iJVZAQglvIZ9hfd/0SjjGTLwxsEq6g8bCbblG2OrMA6 Z9s7oOUg2mmLWgCjs/y3DAlX09QA2gvhJ//B9SAwmB/5SsF+ao47FYIBrrfqo7FI/auH J3HvXBinsocAleL/sGSQCCvgwVH+9Z5vCh0zcemw8DqAiVGYDMCJyI1skA7gwrO/9xxZ NPUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870539; x=1788475339; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AclrZnmx1dt+bWgdQx18LHB9BqExVnIlYnogkUFLNoA=; b=aXeDTWIoySIJpIM7nSLu1D+UmQQy/yV5sXAollNzKPemH4zm8z1Guy/PUfrkXzaGzo 02CFJnpoR/8jwla66h+MPR7yqA7LO4mdCjOxB/9nMkrIvcs5EJyYURW4xk8nlHFANERa SW5gTP6WeMznnkFWgl25BcArDgdoQsn3i23kqhXRcqluD/c/i//VfoDx410xh5PLiuEL yuxAd0UFWHBoMydF/GteCnrOthG7Jm7wNdhcZ1aGy+EJpi/hjmwT6h4xNZRrIGoNPdVd zSIswPBbrVjuV14kWqIqrqdXvxVNFYAD3HAiNnV6YkpFGLhGANkmathG8WCCXzcvxWBI nQbw== X-Gm-Message-State: AFuF++mfReXZUhB7bCCtKvvymfoSwKDZ8yvtkXU4eFjtm9H3TZNTUZ6Q lbPRd5eSFt+kg7yoilHc6ihfQX0Nfw9sOyshpbM++r0wRGZCB2iApSrGM40TDkIh X-Gm-Gg: AR+sD11R+gse7haiD76g1WmkGO3P5VwMJsvd3LqEiER0h4afaWAorl4m80XribQzL4Q v23ROMjcubB4jwMuiNrKoF/HQWhUr9oAYB/x7EoDvzdfZI+MjGfXD+22RjbtkJIsD6XCO/WCJWw fQmBSIfg46yldGiNA/RnPcwSJDgYOl5ydafhmoZC5D1l0uhrrt2o13zZ7S2rgzINh9B6EGwVHBj QC31smKEYo+TeSto9xWckRTQ9a/kWu5iVowahlcbCIjLQkagGi92EIg9YX7lM7hPrCcLW9RQsjC wdk7FvSxinQNCFiEYRibpOf0pnS1q7eFxYXgdxWR6AU2+IQYdxrZMeyZaCos+/LekRoll2UvPpY 9LgyRpmKZXTDvLF0av12jeAJL/1jPivClBkxID0Fx5PxOEClF1aAHziexOiUFXh0FtnO9/1wo4I Jz3koTMzQeulGkbzeozxbrX0TqmX8TE7YeTbyC1Rl6rw== X-Received: by 2002:a17:90b:4a42:b0:37f:e326:6557 with SMTP id 98e67ed59e1d1-396d0e7c071mr4058196a91.4.1787870539423; Thu, 27 Aug 2026 15:42:19 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:19 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 03/10] libsframe: fix memory leak in sframe_decode Date: Thu, 27 Aug 2026 15:41:39 -0700 Message-ID: <20260827224146.3391610-4-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-9.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org From: Indu Bhagat If dctx is successfully allocated by malloc, but the subsequent malloc for tempbuf fails, sframe_decode () immediately returns NULL without freeing dctx. This leaks the newly allocated sframe_decoder_ctx structure. Change the return on tempbuf == NULL to jump to decode_fail_free to address this. Reviewed-by: Jens Remus --- libsframe/sframe.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 712dd0fdb68..d50a9e5689b 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -1448,7 +1448,10 @@ sframe_decode (const char *sf_buf, size_t sf_size, int *errp) /* Allocate a new buffer and initialize it. */ char *tempbuf = malloc (sf_size * sizeof (char)); if (tempbuf == NULL) - return sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM); + { + sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM); + goto decode_fail_free; + } memcpy (tempbuf, sf_buf, sf_size); /* Flip the header first. */ From patchwork Thu Aug 27 22:41:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142348 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5E8ED4BA9012 for ; Thu, 27 Aug 2026 22:43:05 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5E8ED4BA9012 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=aSnMBaJy X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by sourceware.org (Postfix) with ESMTPS id 325574BA79AC for ; Thu, 27 Aug 2026 22:42:21 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 325574BA79AC Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 325574BA79AC Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1036 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870541; cv=none; b=AHwqqMFywf28wCBgUD5dwfpzFD3XXAPvgz0KeR2Rn1tbD13ioCn6aBYERqfHuOFaLMtPB131j9awqHvfm+4uoo/NFW1uVLFZYyWIaAzuNNc5i09X7rae6PeLd7mB6TJ1T4qGtqnjQy842+/0nhE1Bh/b1BSqBLtiqFy8Q5/sY20= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870541; c=relaxed/simple; bh=/W/DuUwKWvPnegSL+ceU7H6fktWD+Gx6Z7Kf/XPwapI=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=Fj+ZUreq+updIaGlkIG7N4XMLdpDtnsSXTXF0b0yKT3K74DIOtIkZLKXVMPAfj1bHQpsG1whnPFAImxwVxX9x+xohrg2MxzgREoAWnciiZlohFi/0Bb6QftFPPFf1h+4O41xT4kwj/JQUkGZYgO2q0+z2UTrMiNCgWpOkfoGI9k= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=aSnMBaJy DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 325574BA79AC Received: by mail-pj1-x1036.google.com with SMTP id 98e67ed59e1d1-396b3d0df94so519909a91.1 for ; Thu, 27 Aug 2026 15:42:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870540; x=1788475340; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kdl773adjg3YXA48/6mSc7ZDgDkpej6T2X9AMThbwi0=; b=aSnMBaJy7PFLNtCoIpE+Z91xYaQUz3iMViw1TB5/5skMl1vgpp8s2O1aPCJzuhiE4N Izzx4FLUVF0b8THM/EJGB8o5tn+gKilWWjwYm4K6orYgWQLaFVVIl2x++E7iAH//JRHX 7jJaEyUh/2vbZTewZzlmaagSW66Z7lJwAkEm3ev43EYTDjs5X/GZK3yhrtRNp8bNVX3x DmkWB8Hm/kbrbEqMKctGikWya/Q91uPzKeLy3M2fDZ4WdcFITv/4KSy0u2//KiT+H5Se 1YPH2er9GHef7zZGTMcm7isTXyP9V47S1GCla8Fri9mGsEWfE/qU6Qb8Eu7K/EKtDKJP 0GZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870540; x=1788475340; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kdl773adjg3YXA48/6mSc7ZDgDkpej6T2X9AMThbwi0=; b=c76SLG1MtO1DSR9v9bDevcuuP2V/C2UdvuxQHFPDcah8qpM9opgqEY9hqFUvq9w7DL PMdM050T+B8TeZmAUfO8QF+WCRPeuAPN8RcCGuVvZSILJfT6QvOA05o1hcIhP7w1454s Nv/uYqgTcLg0P4AVzN3Gt+KcXiZjbP9JtLIRUUIY5TJYo8T1lWvB81IZm88c+MKdKNn6 lCudd2PIynhK5/twpIA1PMXNYJxl6oVoiEv+c94OiguAwFmxxyY2bqrsCEl9B6GM0hWa QuJdksvpMI3Mwkd0/lQ2zGY45JB0tLXB231l+qPne52FR5OMXCu51OU9Zqtwsp/bdJ9h 1cSA== X-Gm-Message-State: AFuF++nBHp3i8RTAAXq2ErRN6dWyHBIz52f+s2varwv3c/o9hoZj1Ka6 F0A9vncvVdsRIjI7qAoNgXgKfu00OgJpW3z8AV7mviXriIL2OqiuWJSGn+Mo7e81 X-Gm-Gg: AR+sD10IFdb0xx0JeezA8ofeFF/PtwjPDrftuXvCLEe7uP41Zcz5cgCg0AB8D5qaWR/ KoSi+NU/Gv/YL560DmL7Lv0prhrlX1mxuweCf0vzeGDn6B45qPoANJVcxXiJAyhvSFWGWSZju4I Nvz19v1QNNe70meB4BsSgMzRPX7dnJ0qC0WWeaytT/rZykSNEzXd8VLHhcq8FxkDZSEjsaUsKaQ 7RrAlsV2NitKUrcOdLuM3+3Wh28hMBwfzd+kfJh1f7Qb1yS8NyORhIY86jfMMUewSTVracQCP9q 94DqxDr512X/BiFwasWEgycLSRtfsDK+WmIhSuyPHRUSkuuBn8etiIoaeNpp3yCBzkuoFlAAXll MPKf02sO7b1MzHONKc32jDr+q6pEnip9QYu4NVpnyey3ZQBmR4hi6P05HwCwql4dJjVn7My++SY ex+7at0lviBniWbvteiE++yxu/omUUSdtiGlObTxpnsQ== X-Received: by 2002:a17:90b:2d82:b0:393:194d:5366 with SMTP id 98e67ed59e1d1-396d0f6f8bfmr4754129a91.10.1787870540191; Thu, 27 Aug 2026 15:42:20 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:19 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat , Naveed Khan Subject: [PATCH 04/10] libsframe: validate FDE/FRE offsets in SFrame header Date: Thu, 27 Aug 2026 15:41:40 -0700 Message-ID: <20260827224146.3391610-5-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Currently, the check for preamble magic, version, flags was done in sframe_decode (), while sframe_header_sanity_check_p () performed minimal sanity check of sfh_fdeoff <= sfh_freoff. There is need to validate header section offsets and length fields (sfh_fdeoff, sfh_freoff, sfh_fre_len, sfh_num_fdes) against the caller-supplied buffer size buf_size. If unchecked, a crafted .sframe section with invalid header offsets may cause out-of-bounds reads. Update sframe_header_sanity_check_p() to accept buf_size and validate: - Header size hdrsz <= buf_size - hdrsz + sfh_fdeoff + num_fdes * fde_entry_size <= sfh_freoff - hdrsz + sfh_freoff + sfh_fre_len <= buf_size Update all call sites of sframe_header_sanity_check_p() to pass the buffer size. This fixes a subset of issues raised in PR libsframe/34273 An alternate fix was suggested by Naveed Khan earlier on the mailing list. This commit is an adaptation of the same. Suggested-by: Naveed Khan Reviewed-by: Jens Remus --- libsframe/sframe.c | 43 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 6 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index d50a9e5689b..4742e4550c2 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -358,8 +358,11 @@ flip_fde_attr_v3 (char *buf, size_t buf_size) /* Check if SFrame header has valid data. */ static bool -sframe_header_sanity_check_p (const sframe_header *hp) +sframe_header_sanity_check_p (const sframe_header *hp, size_t buf_size) { + if (buf_size < sizeof (sframe_header)) + return false; + /* Check preamble is valid. */ if (hp->sfh_preamble.sfp_magic != SFRAME_MAGIC || (hp->sfh_preamble.sfp_version != SFRAME_VERSION_1 @@ -377,10 +380,38 @@ sframe_header_sanity_check_p (const sframe_header *hp) if (hp->sfh_preamble.sfp_flags & ~valid_flags) return false; - /* Check offsets are valid. */ + size_t hdrsz = sframe_get_hdr_size (hp); + if (buf_size < hdrsz) + return false; + + /* Check offsets are within buf_size and sensible. */ + size_t fde_entry_size = (hp->sfh_preamble.sfp_version == SFRAME_VERSION_3) + ? sizeof (sframe_func_desc_idx_v3) + : sizeof (sframe_func_desc_entry_v2); + + if (hp->sfh_num_fdes > (SIZE_MAX / fde_entry_size)) + return false; + + size_t fidx_size = hp->sfh_num_fdes * fde_entry_size; + if (hp->sfh_fdeoff > hp->sfh_freoff) return false; + if (hp->sfh_fdeoff > buf_size - hdrsz) + return false; + + if (fidx_size > buf_size - hdrsz - hp->sfh_fdeoff) + return false; + + if (hp->sfh_freoff > buf_size - hdrsz) + return false; + + if (hp->sfh_fre_len > buf_size - hdrsz - hp->sfh_freoff) + return false; + + if (hp->sfh_fdeoff + fidx_size > hp->sfh_freoff) + return false; + return true; } @@ -733,7 +764,7 @@ flip_sframe_fdes_with_fres_v2 (char *frame_buf, size_t buf_size, /* Header must be in host endianness at this time. */ const sframe_header *ihp = (sframe_header *)frame_buf; - if (!sframe_header_sanity_check_p (ihp)) + if (!sframe_header_sanity_check_p (ihp, buf_size)) return sframe_set_errno (&err, SFRAME_ERR_BUF_INVAL); /* The contents of the SFrame header are safe to read. Get the number of @@ -829,7 +860,7 @@ flip_sframe_fdes_with_fres_v3 (char *frame_buf, size_t buf_size, /* Header must be in host endianness at this time. */ const sframe_header *ihp = (sframe_header *)frame_buf; - if (!sframe_header_sanity_check_p (ihp)) + if (!sframe_header_sanity_check_p (ihp, buf_size)) return sframe_set_errno (&err, SFRAME_ERR_BUF_INVAL); /* The contents of the SFrame header are safe to read. Get the number of @@ -917,7 +948,7 @@ flip_sframe (char *frame_buf, size_t buf_size, uint32_t to_foreign) /* Header must be in host endianness at this time. */ const sframe_header *ihp = (sframe_header *)frame_buf; - if (!sframe_header_sanity_check_p (ihp)) + if (!sframe_header_sanity_check_p (ihp, buf_size)) return sframe_set_errno (&err, SFRAME_ERR_BUF_INVAL); uint8_t ver = ihp->sfh_preamble.sfp_version; @@ -1482,7 +1513,7 @@ sframe_decode (const char *sf_buf, size_t sf_size, int *errp) dctx->sfd_header = *(sframe_header *) frame_buf; /* Validate the contents of SFrame header. */ dhp = &dctx->sfd_header; - if (!sframe_header_sanity_check_p (dhp)) + if (!sframe_header_sanity_check_p (dhp, sf_size)) { sframe_ret_set_errno (errp, SFRAME_ERR_BUF_INVAL); goto decode_fail_free; From patchwork Thu Aug 27 22:41:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142349 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5CEAC4BAE7D7 for ; Thu, 27 Aug 2026 22:43:13 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5CEAC4BAE7D7 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=MYthp3u4 X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pg1-x529.google.com (mail-pg1-x529.google.com [IPv6:2607:f8b0:4864:20::529]) by sourceware.org (Postfix) with ESMTPS id 1D6724BA79AF for ; Thu, 27 Aug 2026 22:42:22 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1D6724BA79AF Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 1D6724BA79AF Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::529 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870542; cv=none; b=MGItOmpXz4R5NU43wlUk77krx55qfmKMIg9npznBPlq8YKBP3OuXAPW28gvNcTPcZ9GbGxlAK3NJNInWUdq5zBuJUEL1+wX792+QVa06Mau3D9yeo24sZQ48xGXXusHClssARZEoemdFxQQfcJ9+qJeIO5GoRwHzKyzgIVAm7/8= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870542; c=relaxed/simple; bh=0FKDYsEPi0KZHHQ6v18mfSbtV5cNx1qJM4xIpQpgJx8=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=lf1njkkr9yAoX/3lZ3gsSwj51ADuL9Xm/emVqS77hkyqXiFF6IPvpRPiDKJ7+g4m24wlFLrxi8EXSApBQ9iatBdk+99W/lxEcs296IPG+D2DPbvobYfNoZZOA4NkIDs9DHCDybM/8On+04ETyxnADpQATIsBsXvCOYNVDJrCQZs= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=MYthp3u4 DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1D6724BA79AF Received: by mail-pg1-x529.google.com with SMTP id 41be03b00d2f7-cbb8b54fcf8so503175a12.0 for ; Thu, 27 Aug 2026 15:42:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870541; x=1788475341; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6Gr9IaW5hA+cqTnw/U9RjidmDE/ko+wUwNkGK9OMTiM=; b=MYthp3u4tNddMNbyF35h5aiiQZU5Vcf0saQYK8i4hG4ic1CRYz58kPJRSwKqkJDHVl keAv9P+EV14dF3QfCZKaZG4/egKdC2yDxiAqwF7AudgEEPqkyMMsOnYOUTf71p+oaFpU /t3/RN2WCsKv64lsUSrZfdZtKYdsF0kHvJJmghwK6iT8k918UhboOjMuZVGAJ2Ktml01 RGzGy3AAUaE8J/3UZZGUj2G4rmruy44hlNY9H4pFrHRr9rRhBtgoO1Pm3CeHBeAhqiaI ZdRDMeDYpGp4Mi10PrSkfKgScZMadhxdDFX57XepjA3bMbWo+8IATCMdSEIMlYsAgeCH MiAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870541; x=1788475341; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6Gr9IaW5hA+cqTnw/U9RjidmDE/ko+wUwNkGK9OMTiM=; b=nI+5gjdGgA/x2Inlsi8gHi2u57tLMyXe2RV2YddZuZ2f184dkl/EFXzx/1bekB2yWb E0MNii5aJA3+n9GPbAK5Fm0Um4Sbfu6O0RQ15+NANgL5/HuV3j7PnVji3y+0bKBuU8ik yVVEvoqBfH+MXorjJNGoh83ZbU13TC7bMgwEm2V3eBamfogqCabcftX49/eA4MbC6mcz oqzKZRThq/QuHApRJrAjaUY5glTvyerrW0RfphEZFYNY8woZ4TendARdaB4zv+kvNg/s wnXpmHZAGbvI8HN4R5+P/lEiazCKvbsgpLT0PM2fDRZ5Vtc/uZ0i/GIERXIM/mQdlSgN ECDw== X-Gm-Message-State: AFuF++n/y4fnFLq60uoqmV89fDAFK2sfJLF4sFZ84t7FXezw2aEn3v6q iHzx0Xp1ZH+RNvr7dL6KcQ7wNMJ1JIorAiQ/dNopUOZLW+OIYj+C7wwTjbokAg== X-Gm-Gg: AR+sD11Ecs1eM84NSyTVg2oWamUoLMK3ez2JQqoAYQRYvI9AWY7n6H2H5UCNKYJjEW/ ooXzs5Ngri7PvJhtwwfuZfCTbzTmilviSf/aYFq7Qk/Dq7czBC1rB68Aq0usfJCgtO73GiE4ASe gX2bkNWQ1THMaW1LQ+YDq8kIfdNGEl8j8YTXiCY52FM54WAso+7G8xgN83oPykBx2v1aczKU/5y w/ViWK/EoWtIMpCggCRjgyEDiJ7NM/CLuaWLOaDfRdfXmE6hxd16D15PdAzmx7yQpZ+wApiQQ4D pM4a4cyHB9u6T/FNY0oOv4+EMOLGoihZ7cSPeQ7bCfiCMWJodslzZBlNCMXcOuvM/IRxlrryHFh /pPI5m3RJbSh5vWsrdJIWTZlDpZ5nK5zukHIJ0cw0ISZDDIyGC0UBw+KICzOn/3ooRU0/NEvlOD puj8bC+Tu7LZ1l7bIY/DMGadJL6r5ryOaevfjAARTnHicjJWPBh2tk X-Received: by 2002:a17:90b:544b:b0:392:b509:b1a5 with SMTP id 98e67ed59e1d1-396d0fdb939mr4077387a91.14.1787870541014; Thu, 27 Aug 2026 15:42:21 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:20 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 05/10] libsframe: handle invalid fre_type gracefully Date: Thu, 27 Aug 2026 15:41:41 -0700 Message-ID: <20260827224146.3391610-6-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org sframe_fre_start_addr_size() previously hit an sframe_assert, when encountering an invalid or unsupported fre_type. This may happen in untrusted input binaries / crafted SFrame data. Replace sframe_assert in sframe_fre_start_addr_size() with returning 0. Update flip_fre() and sframe_fre_entry_size() to check for addr_size == 0 and fail gracefully by returning error codes instead of aborting. Some callers of sframe_fre_start_addr_size () now see additional check for invalid fre_type and exit early. This addresses some issues raised in PR libsframe/34273. Reviewed-by: Jens Remus --- libsframe/sframe.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 4742e4550c2..51b6bf57c05 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -470,8 +470,7 @@ sframe_fre_start_addr_size (uint32_t fre_type) addr_size = 4; break; default: - /* No other value is expected. */ - sframe_assert (0); + addr_size = 0; break; } return addr_size; @@ -534,6 +533,8 @@ sframe_fre_entry_size (sframe_frame_row_entry *frep, uint32_t fre_type) uint8_t fre_info = frep->fre_info; size_t addr_size = sframe_fre_start_addr_size (fre_type); + if (addr_size == 0) + return 0; return (addr_size + sizeof (frep->fre_info) + sframe_fre_datawords_bytes_size (fre_info)); @@ -549,6 +550,8 @@ sframe_buf_fre_entry_size (const char *fre_buf, uint32_t fre_type) return 0; size_t addr_size = sframe_fre_start_addr_size (fre_type); + if (addr_size == 0) + return 0; uint8_t fre_info = *(uint8_t *)(fre_buf + addr_size); return (addr_size + sizeof (fre_info) @@ -707,7 +710,7 @@ flip_fre (char *fp, size_t fp_size, uint32_t fre_type, size_t *fre_size) return sframe_set_errno (&err, SFRAME_ERR_INVAL); addr_size = sframe_fre_start_addr_size (fre_type); - if (addr_size > fp_size) + if (addr_size == 0 || addr_size > fp_size) return SFRAME_ERR; flip_fre_start_address (fp, fre_type); From patchwork Thu Aug 27 22:41:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142352 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id D60B54BA9029 for ; Thu, 27 Aug 2026 22:45:02 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D60B54BA9029 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EJ9/9cOE X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by sourceware.org (Postfix) with ESMTPS id ABA7D4BA901C for ; Thu, 27 Aug 2026 22:42:22 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org ABA7D4BA901C Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org ABA7D4BA901C Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870542; cv=none; b=ui2CxdK9hVbwuAJxClapp7kNNb1ASN8ABC7OKVSgNTVGvRshnj8+hGR5nEhkIEPmy592CeQGAzJZ5WPVeZgCfS7rkBSTFDZ85DhA4v1Y/uEiZmtN57dBMWAxBTRJP8e/t0y2MVmRRifpsz2YO0VX0ceNbVpZtKEKUrvXz+8GQkI= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870542; c=relaxed/simple; bh=yeX8fI7KstZd+QKRuxru39Yk647X68FkKPUC3dG56e0=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=VCc+ZGMq5lEYJBdIZonYNdJ5ctow9xgc1RtB2IX7uE9So3R61pnzVcisj9u2GLNib2uclzvR+7OL+J2AuoDi0xxHBNPiNVzizIIhI6DkYLG5fR6d7PP+fc/wtMX30ba5kLhC76USAWHfWcEfEkMmwz/WOKTcR8kA5P9W0F8RDRs= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EJ9/9cOE DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org ABA7D4BA901C Received: by mail-pj1-x102c.google.com with SMTP id 98e67ed59e1d1-38f620399a0so492686a91.2 for ; Thu, 27 Aug 2026 15:42:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870542; x=1788475342; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nml5btCgQ6uf67/g/0+x63ipgsPpHrELvVMVTWeSUWA=; b=EJ9/9cOE4qMfODDKahEmi2/zv1Z+GlmQmvoRSkxj5MAnFdJAq1caQXCbY0TxC4x9LY +4RjfiaE+MndIkNN0OCmN/wt3U0nWlte6JIIfFC/cT9U2QZhpdbvgJ8zZse6JubDJ4JS x5fhkQkK3zs9ng3mtPQcAvfl6VZQrRcFDrrbVFrlQQiBGhQpZRHiiWMcBOz2+os0jIhL uVJFWfBowFrPkw86PEbT5qqLtoc6WrMM5OIklqRlijCxEFQUAbam5Hs9DrP2ZnD7MQsh 3FV5iHqBR9pxgaZBwpgjTAgxbUuBpXyXuhaNFMNNaFJ9Q6jEsWC4RD3KcyA+TaLlQUrU PezQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870542; x=1788475342; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nml5btCgQ6uf67/g/0+x63ipgsPpHrELvVMVTWeSUWA=; b=WFjj1m5yib6lCbxPKQnnR3nTu86aEt5x8MebP+hBioCbmu401WthOUfiwTHkb2RD23 HMiWfFM8ZUScl3TMu3WvuFXQXvwipXt54JX2plG40TYE8L0D8prTC+H6BwM3xFKth7Ox OEHfzDeToB6zQHy4oM4nNQZB1EEywN5lRcqFyhFucuwnI8Xv2nGO5r+XpL8kXgZX8Vo+ lyT4XCtE/w0wrfYFmSTfq6RtDX384UBbEACuyc90GPgGTgBEDvFsUPdx5GiKtbDKwTU/ 01DWz2xAaDxNx8qJpUQ0q4vAF5MKEfWjTrbH2aMLiM2Nlb6e9FewJJc78PdmTKIDyARD TC8w== X-Gm-Message-State: AFuF++lbDoLM7SNQZO9nVsHkJsDcXQkDy4dr8cB30ztkoCsXp0eem6uh tF1NurrF0QSvYwPDpFOLXPI7+L5ixsCsCHV9+fffR617vTqq9YewzFlPuMU3rg== X-Gm-Gg: AR+sD112xwYCbnJ1iHSA/M2xvZe/rZ3z2OVbGoNJ5HvE34vhVFox064aQbozmQbR3o/ PesGAcJaLOqnBI+MaYt7E/awsutik2A+tv+z+DOEqEtMqNA/NOX6LAKrrrvRTIoEPJpNRJDXsmt qYqrhbnlW//XchUjHUcWF5T3OXNfx4HFV5/nvrbEGfGC+dEIVK2VBDxZU27DXQJ8J6BM9XKEGjS Oik4NTcfaLyu9qVV5JYCplvc2V/ETXsS6mFKrdUppJGxDalMOb4zYu32WILODwhCwuZsTcDJuDF zFDPLr1vJLd1gPlxD9i8oA0RMcQwiW/dR0FUt+PsqVFB2bw3nipK3C3blmv9JHMamZIuTYrzdd3 OAiSntomYCh0Wo698Vp1/wnDPOjIWJzq8r0r1Jgdtz7eDmE2ELXSf64thixxMUbuuLz0uagIAV1 1HgZTJ2163HlA8/oRpc1dkvCimY8yd7W49GK+XXE32Bw== X-Received: by 2002:a17:90b:520f:b0:37c:6130:7a5b with SMTP id 98e67ed59e1d1-396d0ec0d70mr5113368a91.8.1787870541696; Thu, 27 Aug 2026 15:42:21 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:21 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 06/10] libsframe: check error condition in sframe_decode_fre Date: Thu, 27 Aug 2026 15:41:42 -0700 Message-ID: <20260827224146.3391610-7-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org The sframe_decode_fre_start_address API returns SFRAME_ERR in case of invalid fre_type. Check for return value and exit early. Reviewed-by: Jens Remus --- libsframe/sframe.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 51b6bf57c05..288d7c0d873 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -1408,7 +1408,9 @@ sframe_decode_fre (const char *fre_buf, sframe_frame_row_entry *fre, return sframe_set_errno (&err, SFRAME_ERR_INVAL); /* Copy over the FRE start address. */ - sframe_decode_fre_start_address (fre_buf, &fre->fre_start_addr, fre_type); + if (sframe_decode_fre_start_address (fre_buf, &fre->fre_start_addr, + fre_type)) + return sframe_set_errno (&err, SFRAME_ERR_INVAL); addr_size = sframe_fre_start_addr_size (fre_type); fre->fre_info = *(uint8_t *)(fre_buf + addr_size); From patchwork Thu Aug 27 22:41:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142353 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id B629E4BA903F for ; Thu, 27 Aug 2026 22:46:31 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B629E4BA903F Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=ajUsEqYC X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102d.google.com (mail-pj1-x102d.google.com [IPv6:2607:f8b0:4864:20::102d]) by sourceware.org (Postfix) with ESMTPS id 67EC74BA901D for ; Thu, 27 Aug 2026 22:42:23 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 67EC74BA901D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 67EC74BA901D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102d ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870543; cv=none; b=N5q/KMerTjpozEvKTJUvee6bH3Zr5BOXa1f5nyTPgS+9Yga1K5aiLnekliAk8GGiKg2Q7uxmZ02zOnGJgSYAmKBbOYgWVnu2weRI4HVIJ9R4TStojeKYfccWLdM9Iw9Uk306stwKJBPo4DDGSm6iMvKnRmilaj+BnrhWp0cuTT4= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870543; c=relaxed/simple; bh=5JsdXW8T6gHjVQ4FNi7ARdcUWAmwUWbbSUyXJkYjBsc=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=ZW+h9pkrNevPJtlX8/UAm0g0reNLx4RoakwE9ikVny7S07kvhOT2cygs16S9fjckCR29n12PMHMvIXv3xrwkbOJnjNQnTSFswKaOq35zsLYKOeaKc+fDkV1nmzxAEOEoE0oVDii1h9Bfvk1sHmj3JFjQ7pr/NMmn5HPvJHVPxYo= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=ajUsEqYC DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 67EC74BA901D Received: by mail-pj1-x102d.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so455763a91.2 for ; Thu, 27 Aug 2026 15:42:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870542; x=1788475342; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9hMC+6aAWO3mc1oAl4ZgySWrTk5YciYB0szSm8iO5D8=; b=ajUsEqYCZ/T23hGzvgJ8klq/L1O7KOcGdQwkHQ1B8ih32xlSJswpd194wnQn00gClx ij9ujREyTIar4qXXcOZGAZYiEv5vHcs+chtVjgIENYD0vCnAW+htR4Q7G8Bf+j7uPSOp wmyg9WwUk56XttkHObLgbCSoOVZQu9igzn8D/1O76W6MYcedKXKgr3H4/TTAsP+oUr3q WbXB6vT5h/cAjUgR+WGP3nIFxBQuGCJOOS46nIHzujIptOtWzaCqaXZ0hAKFI0evBLUD mQKKQ0lcomngydXUq5Tl4ewRABSaYXwZks+JN04M0K5XAki3gEd1Qhl6WEu7XqbZxlww z1/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870542; x=1788475342; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9hMC+6aAWO3mc1oAl4ZgySWrTk5YciYB0szSm8iO5D8=; b=jht3d+FRqosD4aZCFRskPSzPFWgnGZYhKuiSiIOTXY7Nis/9hnU2dF6gZTKHIwUc6s WsOjSYwWP671zllJ9YdEfrC74IDlMKM68pWkiOzk93kekobLZzdkoBfQQFXdYLDKXBv9 Wn5lmPjjpzS1BEcAQfYgJ5gNBFLeRblTKqnvfu2+lgKKp1t5mUOU9D1+pBsQbgCdFYIs oo34sbVsjW8lg42UT+oWAW0rKqnKnIMeGnt1Relz4DTkhwyCHmdoPqigZREWAdVF6eiY vbEpx8gdj8nagI7OL8Zg6LgdBYhhz3OmuyGUkV9D36TYBVcIWuqGcbM29puVR2lk7Jb3 Ebvw== X-Gm-Message-State: AFuF++nZRyX7dCa693IUHsvnSY06Ci4YPPSkWDFkBH4R9NFt983jugvI XGeRfLKgM+HZV6zd6ajgQxzBQfEB67WYlCxCLKmdLQpzxc9zFV7NgLQkfIBj93yx X-Gm-Gg: AR+sD12UttP0EJ7szEqUyXYlWcHB+PsQIZOiCk2lrWtWF85D4XbNxN5cveKMRkT+W9k pEtvncOI3RfDcsN2k3z+xLz7o12/7O/DBDXAa+Dtti7xxN8HP9y4x4MhqXrQVNnvl7fCwCY1Vog 4bUC4JjAX5EZj+MQhliVzMXBfB4omYzYBSk1BnV1uzCvuqBjUIPFMetajPKbqlJUb14ASMrsVYm jCMim957HxA5QoOY9YnUg11nR12JSHUxLl8yt70zTW0aG/ZqYylqST8O6Q+tUnSE29JUznjb15J Qe/aXSMrXoncXDCLEnh8oRVEp6VZa5e70XNiKh8tE30D/yrw5F/pCXYqgHQWgN+/HPhVrasE5+I wHVnBFGDCot/fg+tE96GmNwk1g+5enwEI9HAuic1NtUQmE7KnFpAwhcu++qDHsJc5dVN4nd+yR3 lp6h54urJdsoqW7ejcCprwvv8bomV2DjxKbjtR7HstBg== X-Received: by 2002:a17:90b:1dce:b0:38e:5b59:c2ff with SMTP id 98e67ed59e1d1-396d0ea8b47mr4890371a91.3.1787870542378; Thu, 27 Aug 2026 15:42:22 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:22 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 07/10] libsframe: guard against buffer over-read in sframe_fde_tbl_init Date: Thu, 27 Aug 2026 15:41:43 -0700 Message-ID: <20260827224146.3391610-8-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org In SFrame V3, the FDE attribute data is stored near the SFrame FREs. In sframe_fde_tbl_init(), for SFrame V3 format, fdep->sfdi_func_start_fre_off was used to index into fre_buf without verifying if sfdi_func_start_fre_off + sizeof(sframe_func_desc_attr_v3) <= fre_buf_len. If left unchecked, this may cause buffer over-reads in case of invalid SFrame data. Pass FRE buffer len to sframe_fde_tbl_init(), and validate sfdi_func_start_fre_off against that guard before reading FDE attribute data. Reviewed-by: Jens Remus --- libsframe/sframe.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 288d7c0d873..f047342a782 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -140,8 +140,8 @@ sframe_fde_tbl_alloc (sf_fde_tbl **fde_tbl, unsigned int num_fdes) static int sframe_fde_tbl_init (sf_fde_tbl *fde_tbl, const char *fde_buf, - const char *fre_buf, size_t *fidx_size, - unsigned int num_fdes, uint8_t ver) + const char *fre_buf, size_t fre_buf_len, + size_t *fidx_size, unsigned int num_fdes, uint8_t ver) { if (ver == SFRAME_VERSION_3 && SFRAME_VERSION == SFRAME_VERSION_3) { @@ -155,6 +155,10 @@ sframe_fde_tbl_init (sf_fde_tbl *fde_tbl, const char *fde_buf, fde_tbl->entry[i].func_start_fre_off = fdep->sfdi_func_start_fre_off; /* V3 organizes the following data closer to the SFrame FREs for the function. Access them via the sfde_func_start_fre_off. */ + if (fdep->sfdi_func_start_fre_off > fre_buf_len + || (sizeof (sframe_func_desc_attr_v3) + > (fre_buf_len - fdep->sfdi_func_start_fre_off))) + return SFRAME_ERR; const sframe_func_desc_attr_v3 *fattr = (sframe_func_desc_attr_v3 *)(fre_buf + fdep->sfdi_func_start_fre_off); @@ -1535,7 +1539,7 @@ sframe_decode (const char *sf_buf, size_t sf_size, int *errp) /* SFrame FDEs are at an offset of sfh_fdeoff from SFrame header end. */ if (sframe_fde_tbl_init (dctx->sfd_funcdesc, frame_buf + dhp->sfh_fdeoff, - frame_buf + dhp->sfh_freoff, + frame_buf + dhp->sfh_freoff, dhp->sfh_fre_len, &fidx_size, dhp->sfh_num_fdes, sfp->sfp_version)) { sframe_ret_set_errno (errp, SFRAME_ERR_BUF_INVAL); From patchwork Thu Aug 27 22:41:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142354 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 781C54BA79AF for ; Thu, 27 Aug 2026 22:46:51 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 781C54BA79AF Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=BEyYyHoT X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pg1-x52a.google.com (mail-pg1-x52a.google.com [IPv6:2607:f8b0:4864:20::52a]) by sourceware.org (Postfix) with ESMTPS id 3141D4B9DB49 for ; Thu, 27 Aug 2026 22:42:24 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 3141D4B9DB49 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 3141D4B9DB49 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::52a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870544; cv=none; b=EoRVppe5MSMOMExgETq7xqHXq5Q0O6UOBAIk4N5IXlYDTxvHLl2/20Lh7PqEb5KSJzpX0Kp6Z64Qw2dnBoV4rbjdFEgLi78jpkZAAAe3y3QRjE6zAsZLhWMN2tGrhl3KaElR5llMNFoof0+cZ+pyt/1Go5/BWKLcNVVJziDSEZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870544; c=relaxed/simple; bh=NaLzFQF7ncSfXVbyBvAJXbCzdh+E72HqwiYLKrZ8uHs=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=a1/PMGoJAN9fNeAmIG+vPpoMgPQa2H8Gz/4nbsh85r1NQhoKvghRbE72yYMPZMsT9UYD5Fvd41j3cY/PVad90vQ7NVHF+Y6HzFa7h/QzQMC/H8MqPTUGBfuYiZ1M/zZPlPBTJs5WtkoM2Kk5nLYZpICQDrSX30YJFG5dtcf7RZE= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=BEyYyHoT DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 3141D4B9DB49 Received: by mail-pg1-x52a.google.com with SMTP id 41be03b00d2f7-c9b373d5af0so164397a12.2 for ; Thu, 27 Aug 2026 15:42:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870543; x=1788475343; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZHRInbEZV/1WHsbN/s593rLA1lNq86OXzn8P+A9QF24=; b=BEyYyHoT9JPEpiC8vBnzhLNMpp9I7TI23R2bMCF1Un8k5SCW6lnGvGUjGle6fxPQ6u 1Pccs72GHuGqIyN8YCdYY69Y8AblxIGCO0Vfk+0XkxwWraEAGld0F902yrZ60tUw+oiT KUSwH7vD8Jd49LLZxKuSHwd+4TSACn4ZHiaTfUAhOTBtrlgnbJN+kTHUHaK+F/dZgjR9 avBdpsGSi0DZ5OsGJuFqI0tziaccz2mdeLeGZnWs9ejMdtO5s7nPhiWSgf8nVs6+XsaG iXBABJb5SgmjHnfHKDf7sQLSEko4b1p5SyRqzM2/wuYcu4+VF8jRD1EZPfCiE97RKumK i4+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870543; x=1788475343; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ZHRInbEZV/1WHsbN/s593rLA1lNq86OXzn8P+A9QF24=; b=YnN0QDembF5V5/hUPuqcaplyZDk/4dZCKwzxz8zOMTVCycUB7qojq/SyQwtpXXSnhb BywjiMFInkycPuFUjaNTA8WCpFtq3MxxTsZEZ8ju7UwOhzHo2v5XYDcKP4ev3QXsN8uH 1ws4Ss8bB9gVWQL7WnSY6Z/w3U3nl2ee5QfmxmOP1lOuvCZ4gXflaSgcuv0HZ8mfNzo8 VVCmHh+xK5sT7ediEeSUaFmO0bdDkYyW+eiS0VjN2ibNFMnHBpNQz8gmvxE0W/XaD7NM EtWeVFCU0X7tDErQfcBZ0YCimul4xrUmwNsVQvHCBdhRplgWl/rOnAAqjCI7VK5cL3Wd qahA== X-Gm-Message-State: AFuF++kW7ALI1kGWkANCYMF2DPQZX2rim9hfQzQqPEgjQdcdNVFiZJwO 5JbEYUTQWRz+f3DqnfZViBDHwMDHEkmVH2lnK5c+Btsk+wwdtuKR84a8OftkdA== X-Gm-Gg: AR+sD120jCmMIHazlz44UfcklpRsqXNElhtf1tmyFAWBuU+c+dqs/qe4QWOQHFlm/4L VhiHf+o2hxJo9OF7QxkGPp5IG6ccxW6fK7a+Tw1gxiCXbLX55TjxhYayZcriFIAmO8V7oPShmQW iqhATFYBcCNljWbx/HjIaxD+tEYxUQ7VUfOADcRNi9m4Wblqo3G8Kgx1l7flJ8zWmJCyIeP03Gp hn/NG0iJ+hybrbsPzn5pla+AOZoxHpvSYMGYPviQMTMXX0vgK2WIgh3dAHfceLqBsk1OR3bMh05 gO2a7nWsHmupZJ63qKR0NqbIJ/IL8YxOq3k9Ntl5LHilmnsdVMnS71eKWEwUz4lE6ViV83kVzf8 fXWXTl72pzXcxYKKtVrthXFnXWvfAWaAapHhpza56UbzBDnWIHqzxd3qQKuj3R/ZP12+OIWYQZe 0+z+jZ2vNsS2ua/16AfsRzXZT7+vWJlZgn5KPSydZmIw== X-Received: by 2002:a17:90a:15d6:b0:396:d28e:bd8 with SMTP id 98e67ed59e1d1-396d28e1164mr2562741a91.3.1787870543199; Thu, 27 Aug 2026 15:42:23 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:22 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 08/10] libsframe: check for overflow in sframe_fde_tbl_alloc Date: Thu, 27 Aug 2026 15:41:44 -0700 Message-ID: <20260827224146.3391610-9-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.4 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org sframe_fde_tbl_alloc() allocated memory for internal FDE entries based on num_fdes * sizeof(sframe_func_desc_entry_int). If num_fdes was very large (malicious input data), integer overflow could occur during size calculation, producing a smaller allocation and resulting in potential buffer overflow. This addresses some concerns raised in the PR libsframe/34273. Reviewed-by: Jens Remus --- libsframe/sframe.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index f047342a782..5ddd3962212 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -124,6 +124,12 @@ sframe_ret_set_errno (int *errp, int error) static int sframe_fde_tbl_alloc (sf_fde_tbl **fde_tbl, unsigned int num_fdes) { + size_t max_num_fdes = ((SIZE_MAX - sizeof (sf_fde_tbl)) + / sizeof (sframe_func_desc_entry_int)); + + if ((size_t) num_fdes > max_num_fdes) + return SFRAME_ERR; + size_t fidx_size = num_fdes * sizeof (sframe_func_desc_entry_int); size_t fd_tbl_sz = (sizeof (sf_fde_tbl) + fidx_size); From patchwork Thu Aug 27 22:41:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142347 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 151994BA79AC for ; Thu, 27 Aug 2026 22:43:02 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 151994BA79AC Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=jEudJACT X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) by sourceware.org (Postfix) with ESMTPS id 232F84BA79AF for ; Thu, 27 Aug 2026 22:42:25 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 232F84BA79AF Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 232F84BA79AF Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1031 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870545; cv=none; b=KRtvW/4pq6ZgsJowaxoIMAPGwFDNrUqvaKByyDz95pg/lcs6inkPI+XXJWkOMguUFO6dq78CcHcWTcIpU7DQv5teARW6SRSZLg6IA/BFkM7DDLE9U/Dp4wnsYq8sTRh48JqmNRthvfQkdglzfS3ZgDCcI/7H4uILLGZCc0za+iE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870545; c=relaxed/simple; bh=Z1yDMgEgr91gMA7QrEu5sXxWbD6fjMy/t1zP7U3M76I=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=RuMBbX0o4YdD2YUDwzed5/liNyHJwFqc/VstqNGfTFKYbOkVbXodrdyOxkvWqUwt+iCK1ILFqWH/kSXsqcBthfRAGa+PQRI2nYUN81VMCjgkb2GUmWoLNbptk+9U6wZbPVmskFyP/bAzGStztJ6Iz6D+dLcyvk5I1JbwI6LWl50= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=jEudJACT DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 232F84BA79AF Received: by mail-pj1-x1031.google.com with SMTP id 98e67ed59e1d1-38f620399a0so492710a91.2 for ; Thu, 27 Aug 2026 15:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870544; x=1788475344; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ln1YctETfnGsEguTrkJm2+gt1cwnSRjog4DdI3uFK0o=; b=jEudJACT7BQSmoifUsAxhjCTR1EazFL60M8yst4+DKpRQXh0TK3FIsjNy8oQ8pHoIK DHWTTW8H7afqlJsb+u2cDHuXX1ViX5sTQsp8bHvM70lmqTXuszj2hTOO6xzl0CclUdgz EhBcJi3Xz3qot3xhS/dkyaG/SDAwV96CLfE7tuqJ2W0mf3dtqyPMZeWZdfvsxl4GPEBK G+gMYCr8ixzxYSRcfz81CXk9XZK6Adizhq7zrCWMyJye/8LaXbuy7bqhwVqcinp0ZBBK mh3CEKkZnyRqcIcAO2U0q7AI3qupTt8W+q3hGCC6OAJsOyxvvxgau7gdcPl/garQ2TeD JL5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870544; x=1788475344; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ln1YctETfnGsEguTrkJm2+gt1cwnSRjog4DdI3uFK0o=; b=G/683Jls4b1OVf3x6OaCJpM/iCpxB2Xo0syvG8oikGt4TZ2HqMHnprjD46mqnI+YjU oMJi47RSF7rtA9t52LGHLQkaXMPtWYUfnyfdwwQFYB5SVdPqnLZLw0tZ60ke8fH4FhJC K9MxV7qdOP0vrAXoh1bHAqIcN8QiQdqiP1Z/bhXILWjOphkCMpYJ94DHNW8r51lqDOzv 1xf8pQBgsba/XJ9xkEJjl+1VwA/KMow+3Jdsr4QXNoBtlRhdQhL3ZwAW0RmcEx+ZSj3R +xod1dbjo8/UkzsKf310yN7xY8vGlx1fJ4Ahxe6zp0ufrJO7O8kHhElU1Ykk6FjuxMma UqIQ== X-Gm-Message-State: AFuF++kZyjYYUZB8lpBzGlpnPzTuLRKWoJwedpM7EyB37LVDnSx+kr8o 7aNIWNxKdo+CkMigBovBM+Pu9UkqFiRALFRquPjrDjaMnTeCQQW/ai9A234L5A== X-Gm-Gg: AR+sD100f8WnnG6zYHSWxGtBfhJvx77XXXjgmrAiun1vU+1iP0gI6/PDNm3TlZ3MHkl aBrMBiTbHWBgd+uj2yEXp1kXPtogq/rtqjFvW44atUTaXFOpX6jtxr8yb2ak5YnBIyP90zxF9uL W/f1e/tXpOG5blHxnNFRkEhBuU1urIBrtHH+NJBft3HvITK00cbtyTUOf6rujD+cND2E9iKh4PD r8XtElgA3TIaUGLHf6irqaJaDJIssuBsbnE0y7MF80eLqFEHTiNeT5SZTao5arWYz9LVF/VBw8B L87dIupwTddlfMTtWmwEXYYIWi9JwjtqIrRHTqv/7JylLFsFl6keUtJ/kQ75pkQ6qpi1f6P1ODj 9dNLYY0q67OZ1L+AH4n7NhFt9m8LqWAqKLttX63NsjaVV2J1jfLdJaOMYT3OinWQyL781/roSH/ 0mH5PnDhy5Fa2RzSZEFL+LVC0qxql64ibCVNHfLrCb4nuY8l5CalQ34g== X-Received: by 2002:a17:90a:d44d:b0:38e:c7b0:84ad with SMTP id 98e67ed59e1d1-396d0c15f3cmr5060036a91.0.1787870543971; Thu, 27 Aug 2026 15:42:23 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:23 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 09/10] libsframe: validate bounds before reads during endian flipping Date: Thu, 27 Aug 2026 15:41:45 -0700 Message-ID: <20260827224146.3391610-10-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Currently, in both flip_sframe_fdes_with_fres_v2 () and flip_sframe_fdes_with_fres_v3 (), the pointer fp to a location in the SFrame FRE subsection is calculated using the unvalidated offset fre_offset read from the SFrame section: fp = fres + fre_offset If an invalid or malicious SFrame binary contains a large fre_offset (sfh_freoff is already validated in sframe_header_sanity_check_p), fp may point past the buf_end. Validate fp pointers in flip_sframe_fdes_with_fres_v2 () and flip_sframe_fdes_with_fres_v3 () before calling the code to flip FREs. While at it, also address similar issue with fdes location access. This addresses some of the issues raised in PR libsframe/34273. Reviewed-by: Jens Remus --- libsframe/sframe.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index 5ddd3962212..d3af9717fe2 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -794,7 +794,7 @@ flip_sframe_fdes_with_fres_v2 (char *frame_buf, size_t buf_size, size_t fsz = sizeof (sframe_func_desc_entry_v2); for (i = 0; i < num_fdes; fdes += fsz, i++) { - if (fdes >= buf_end) + if (fdes >= buf_end || (size_t)(buf_end - fdes) < fsz) goto bad; /* Handle FDE. */ @@ -817,6 +817,8 @@ flip_sframe_fdes_with_fres_v2 (char *frame_buf, size_t buf_size, fp = fres + fre_offset; for (; j < prev_frep_index + num_fres; j++) { + if (fp < fres || fp >= buf_end) + goto bad; if (flip_fre (fp, buf_end - fp, fre_type, &esz)) goto bad; fre_bytes_flipped += esz; @@ -890,7 +892,7 @@ flip_sframe_fdes_with_fres_v3 (char *frame_buf, size_t buf_size, size_t fsz = sizeof (sframe_func_desc_idx_v3); for (i = 0; i < num_fdes; fdes += fsz, i++) { - if (fdes >= buf_end) + if (fdes >= buf_end || (size_t)(buf_end - fdes) < fsz) goto bad; /* Handle FDE. */ @@ -909,6 +911,10 @@ flip_sframe_fdes_with_fres_v3 (char *frame_buf, size_t buf_size, /* Handle FDE attr (only in V3). */ fp = fres + fre_offset; + if (fp < fres || fp >= buf_end + || (size_t)(buf_end - fp) < sizeof (sframe_func_desc_attr_v3)) + goto bad; + if (to_foreign && sframe_decode_fde_attr_v3 (fp, buf_end - fp, &num_fres, &fre_type)) goto bad; @@ -926,6 +932,8 @@ flip_sframe_fdes_with_fres_v3 (char *frame_buf, size_t buf_size, fp += sizeof (sframe_func_desc_attr_v3); for (; j < prev_frep_index + num_fres; j++) { + if (fp < fres || fp >= buf_end) + goto bad; if (flip_fre (fp, buf_end - fp, fre_type, &esz)) goto bad; fre_bytes_flipped += esz; From patchwork Thu Aug 27 22:41:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Indu Bhagat X-Patchwork-Id: 142355 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 000934BA2E10 for ; Thu, 27 Aug 2026 22:48:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 000934BA2E10 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EejsrNu0 X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by sourceware.org (Postfix) with ESMTPS id E191C4BA901D for ; Thu, 27 Aug 2026 22:42:25 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E191C4BA901D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E191C4BA901D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870546; cv=none; b=c2AyT5lvOFhvMcOsB3KmxIQRiEcg9PAX8MyTLIBTa+Vw4Fas5gmWMZRXvZUUtAOTEBEtpPpT7S1Bi8QoRyECPcpLoOPq93vDGDHro2T/dRMUEBhU8I0OR1p3s431qPTh1BIAqQM3cxrQXIe7MFNmHSbhmgHoZS5QiQIDLSf8nQk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787870546; c=relaxed/simple; bh=e5KUzNfd5/QBr5V9t4k8nSZmgVf+PCVSkXxsWoCsJew=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=bLrW61p2JWaYUTBu4Ip5hci7UWo8XpsUG+XtKKGNnmSGh5yerdfTgtaZ2QwC2aYH7bjzwH1zQWUDmJC7OR3zAhk2+4wWW2cg9kTe0pheNaUxOpBKmmNFm1o543+pdV+uZr+Q5qOMEqvgrZDlBcTnngZff1gv5/dsANFgNjINrYk= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=EejsrNu0 DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E191C4BA901D Received: by mail-pj1-x102c.google.com with SMTP id 98e67ed59e1d1-382ef647e20so272480a91.1 for ; Thu, 27 Aug 2026 15:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787870545; x=1788475345; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DeOAG6/mGtAxQtASDgZqQrSMSsewsqyh6nnNJlN6nfw=; b=EejsrNu04f7fT0sweiNFmdsZzZ79exAZizpY+OCdiWlE+MIXOE/Rev6l/ozcgh9lCQ VhcBXIrteLmcCSdGzQX3CCCSg/vH9lmCAMlOh0ZxEZqZjpsygWw3bPwtnIULs8nVY8SQ sYX/LFjijnd6ZqiKHpnrT1iQgyqqaO6iE0NfTTQL47/cBlapELeEsZ3Mja6DBE0AlYUT NBb11PdjIM62zmqBzel+mlkxiJEt32NeCXJ+quPrPuWZOeLqwGLisk0c5AgOlNexLObM E1WQAYK7OymxoJBec78BIpRM7U0zEOBS4kYZmIRCnWEOkUBLJGkhvLFoGrzGzBa6ZU1F nS2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787870545; x=1788475345; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DeOAG6/mGtAxQtASDgZqQrSMSsewsqyh6nnNJlN6nfw=; b=DLpBVyc8f/L1X+6IfxdHjAeJrBZe6+JDqyk+uVGH1cF5lQ3T02eh9Dd2Aegsabv0kf g5dUyoZ43R4Dd3r1K3BH0cN4tkapaRWlW0leyv/5ceWk12Y/CzQ23vuzrNDTwWxE/dUN TSJzSbAfnX8syexHQ8ZFznm+qnbrk2YnsWgzZQc43zYeHIFOQ3mxRmp/8NwSYn31v1w5 jS+LiLsQrykP0U/27DPh0+vsPL3Cpo7SoDJdehLpqZ8TuKUNq/PWXsYnk6e3U1RfZpND cgXMXvfU+UTsE6faMz1cQyeZeG4ld6tyOr70FGIXdw88Lk7DXkWGxjn/KEl5U8QG1Ags LbGA== X-Gm-Message-State: AFuF++kBIgcCS+OSumnh64QLKO9mons630a2Qn7wIMw3hGl9ZRnVjmjh s1QvHH6i2DonNDbmy5jBc3GVLlbI0sUKnfqgctlzCbM9IVfzwvzw6cuQ4uVtKV6R X-Gm-Gg: AR+sD10hUYQLcDXOGJ4vUCag6cCnWziAXNPeNtj5K6H9qH3xQ4cpKGOEDD3MZe2najT pMzHOnmEThPCJRxg7G6Xp5TTKoZ4g1h8/fDNMxM5/9Yig3bWNENpayanI55mxaOFVC2B9S/U98k o2X9VzPcJI8lHJTeRmLIGwJyztg4/Pr+EsXcvZbUnXfVm0eUJGch1GzdDayiN8vRI5100uDD3TG U20wQQHYHKp6y9+1lQH3xDiKKD6kBYDmmrOrf9REE+zitt42g7N5+kiUCy+0X4/vWss0uKcDdfl lxt6MjYwq+xe/i6nYbWaNHLHW/hJ/MHI23wQD9Oz9/MpUs0IGcEXWEoHAWQMVAnGHZTBRWEnyNt YvqOwUsW5vXm7t0vBOhVOQQdevZpoBYt4aXCXHGp2AatRci+M1oEUulqPDSPO94rlX1sfmODhGR 4hkgCY6xg5Mf8s3a1Df7XbpYjKoDef//PC9RG7afrKAg== X-Received: by 2002:a17:90b:51c7:b0:38f:5801:dc0e with SMTP id 98e67ed59e1d1-396d0f52b2amr4654251a91.15.1787870544971; Thu, 27 Aug 2026 15:42:24 -0700 (PDT) Received: from fedora.. ([2604:3d08:9582:1100::d625]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396b0d80008sm4506694a91.6.2026.08.27.15.42.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 15:42:24 -0700 (PDT) From: Indu Bhagat To: binutils@sourceware.org Cc: jremus@linux.ibm.com, Indu Bhagat Subject: [PATCH 10/10] libsframe: fix PR libsframe/34417 Date: Thu, 27 Aug 2026 15:41:46 -0700 Message-ID: <20260827224146.3391610-11-ibhagatgnu@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260827224146.3391610-1-ibhagatgnu@gmail.com> References: <20260827224146.3391610-1-ibhagatgnu@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-10.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org For crafted SFrame data, malicious content in fre->fre_info may trigger a datawords_sz calculation to be > MAX_DATAWORD_BYTES. Check for bounds before memcpy. While at it, detect failure in the callers of sframe_decode_fre and return early. Reviewed-by: Jens Remus --- libsframe/sframe.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libsframe/sframe.c b/libsframe/sframe.c index d3af9717fe2..31ef751e1e1 100644 --- a/libsframe/sframe.c +++ b/libsframe/sframe.c @@ -1440,6 +1440,9 @@ sframe_decode_fre (const char *fre_buf, sframe_frame_row_entry *fre, memset (fre->fre_datawords, 0, MAX_DATAWORD_BYTES); /* Get offsets size. */ datawords_sz = sframe_fre_datawords_bytes_size (fre->fre_info); + if (datawords_sz > MAX_DATAWORD_BYTES) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); + datawords = fre_buf + addr_size + sizeof (fre->fre_info); memcpy (fre->fre_datawords, datawords, datawords_sz); @@ -1925,7 +1928,9 @@ sframe_decoder_get_fre (const sframe_decoder_ctx *ctx, for (i = 0; i < fdep->func_num_fres; i++) { /* Decode the FRE at the current position. Return it if valid. */ - err = sframe_decode_fre (fres, &ifre, fre_type, &esz); + if (sframe_decode_fre (fres, &ifre, fre_type, &esz)) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); + if (i == fre_idx) { if (!sframe_fre_sanity_check_p (&ifre)) @@ -2305,7 +2310,8 @@ sframe_encoder_add_fres_buf (sframe_encoder_ctx *ectx, { ectx_frep = &fre_tbl->entry[fre_tbl->count]; /* Copy the SFrame FRE data over to the encoder object's fre_tbl. */ - sframe_decode_fre (fres, ectx_frep, fre_type, &esz); + if (sframe_decode_fre (fres, ectx_frep, fre_type, &esz)) + return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL); if (!sframe_fre_sanity_check_p (ectx_frep)) return sframe_set_errno (&err, SFRAME_ERR_FRE_INVAL);