Hi Sujal, Thanks for the patch, merged.
Aaron On Thu, Nov 5, 2026 at 3:32 AM Sujal Tuladhar <[email protected]> wrote: > > Hi, > > The attached patch fixes a heap out-of-bounds read in eu-readelf's > print_debug_str_offsets_section when a .debug_str_offsets section ends 1 to 3 > bytes after a table. > > The initial 4-byte unit_length is read before checking that 4 bytes are left; > the loop only guarantees readp < readendp. The DWARF64 length and the > version/padding reads that follow are already checked. This is the readelf > counterpart of PR 34383, which commit 6f8f78ce fixed only in libdw's > str_offsets_base_off; the patch adds the same check to readelf. > > Reproducible with eu-readelf --debug-dump=str on a crafted ELF whose > compressed .debug_str_offsets holds one valid table followed by 2 trailing > bytes; ASAN reports a heap-buffer-overflow READ of size 4 at the unit_length > read. The patch (git format-patch, applies on HEAD 10b728d8) is attached. I > can send the reproducer file, or add it as a test case, if that helps. > > Thanks, > Sujal Tuladhar
