diff options
| author | Darren Carreras <carrerasdarren@gmail.com> | 2026-08-13 20:43:18 -0400 |
|---|---|---|
| committer | Andrii Nakryiko <andrii@kernel.org> | 2026-08-21 12:00:30 -0700 |
| commit | e40f61a31688898e7cf81e91074a42f805883e4d (patch) | |
| tree | 294749ab7bbe00fdf2ae5d6e7d9d64ff98d68a94 /scripts/Makefile.thinlto | |
| parent | 4954de7dbd1cfafecafcf7e4e801c50c11be49d9 (diff) | |
| download | linux-next-e40f61a31688898e7cf81e91074a42f805883e4d.tar.gz linux-next-e40f61a31688898e7cf81e91074a42f805883e4d.zip | |
libbpf: Avoid overflow in BTF.ext bounds check
A malformed BTF.ext subsection length in an ELF input can wrap the
pointer addition used by btf_ext_parse_sec_info() on 32-bit builds. The
wrapped pointer passes the bounds check and parsing then reads beyond the
copied BTF.ext data.
Ensure the header fits in the copied data, then validate the subsection
offset and length with subtraction before forming its pointer.
Fixes: ae4ab4b4117d ("btf: expose API to work with raw btf_ext data")
Closes: https://issues.oss-fuzz.com/issues/477315119
Signed-off-by: Darren Carreras <carrerasdarren@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260813-b4-libbpf-v6-send-20260813-v6-1-56be61c52758@gmail.com
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions