serge1 / ELFIO

ELFIO - ELF (Executable and Linkable Format) reader and producer implemented as a header only C++ library
http://serge1.github.io/ELFIO
MIT License
726 stars 157 forks source link

string_section_accessor_template::get_string can walk past end of string table #101

Closed Alan-Jowett closed 2 years ago

Alan-Jowett commented 2 years ago

If the string table is not well-formed (i.e. the doesn't end in a NULL), then this function will return a pointer to memory that is past the end of the string section. In string_section_accessor_template:

    const char* get_string( Elf_Word index ) const
    {
        if ( string_section ) {
            if ( index < string_section->get_size() ) {
                const char* data = string_section->get_data();
                if ( nullptr != data ) {
                    return data + index;
                }
            }
        }

        return nullptr;
    }

Code only validates that string begins within the string table section, but doesn't check that there is a null terminator.

serge1 commented 2 years ago

Fixed in PR #102