st_name is never checked against ef->strsz
The existing test st_name == 0 only weeds out symbols that have no string; it does not stop a bogus, out-of-range offset from being used.
Differential D57810
link_elf: Unvalidated string‑table offset (link_elf_lookup_symbol1) Authored by thebugfixers_pm.me on Wed, Jun 24, 9:08 AM.
Details
st_name is never checked against ef->strsz The existing test st_name == 0 only weeds out symbols that have no string; it does not stop a bogus, out-of-range offset from being used.
Diff Detail
|