vbpf / prevail / 28819846306

87%

push

github

Match subprogram relocations to their program by identity (heap OOB write) (#1161)

ProgramReader::append_subprograms selected function relocations by comparing
raw_programs[reloc.prog_index].function_name to prog.function_name, then
applied each with prog.prog[reloc.source_offset].imm = ...

reloc.source_offset is an instruction index into the relocation's OWNING
program (raw_programs[reloc.prog_index]), not prog. ELF symbol names are not
required to be unique, so two STT_FUNC programs can share a function_name; a
relocation whose source_offset is valid for the larger program was then
applied to a smaller same-named program's instruction vector via unchecked
operator[], a heap out-of-bounds write reachable from a crafted ELF (before
any --section filtering).

Match the relocation to its program by pointer identity
(&raw_programs[reloc.prog_index] == &prog), which is stable during the
append phase.

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

1 of 1 new or added line in 1 file covered. (100.0%)

9141 of 10571 relevant lines covered (86.47%)

6473705.38 hits per line