konrad-kruczynski / elfsharp

Pure managed C# library for reading ELF, UImage, Mach-O binaries.
https://elfsharp.it
Other
159 stars 57 forks source link

Fix large string table index #93

Closed chusitoo closed 1 year ago

chusitoo commented 1 year ago

Hi Konrad,

This fix is very much related to the change introduced in https://github.com/konrad-kruczynski/elfsharp/issues/89

The PR addresses an edge case best described in elf(5) — Linux manual page:

e_shstrndx
              If the index of section name string table section is
              larger than or equal to SHN_LORESERVE (0xff00), this
              member holds SHN_XINDEX (0xffff) and the real index of the
              section name string table section is held in the sh_link
              member of the initial entry in section header table.
              Otherwise, the sh_link member of the initial entry in
              section header table contains the value zero.

The problem would manifest itself in the following error message:

System.InvalidOperationException : Given index of section header does not point at string table which was expected. Stack Trace: at ELFSharp.ELF.ELF'1.ReadStringTable() in /opt/elfsharp/ELFSharp/ELF/ELF.cs at ELFSharp.ELF.ELF'1..ctor(Stream stream, Boolean ownsStream) in /opt/elfsharp/ELFSharp/ELF/ELF.cs at ELFSharp.ELF.ELFReader.Load[T](Stream stream, Boolean shouldOwnStream) in /opt/elfsharp/ELFSharp/ELF/ELFReader.cs

The solution is very similar, essentially checking if the value of stringTableIndex is SHN_XINDEX and, if true, assign the real value from firstSectionHeader.Link

I'm also adding a test binary in a separate PR into https://github.com/konrad-kruczynski/elfsharp-test-binaries/pull/3 that would catch this problem. Feel free to integrate the changes yourself if you find this dual PR approach is too messy.

Cheers, Alex.

konrad-kruczynski commented 1 year ago

Thanks for the PR, I'll update submodule and all the release stuff and I'll release it.