debug/elf: use saferio.InBounds to prevent offset overflow #75522

callthingsoff · 2025-09-18T12:46:20Z

When applying relocations, a malformed ELF file can provide an offset
that, when added to the relocation size, overflows. This wrapped-around
value could then incorrectly pass the bounds check, leading to a panic
when the slice is accessed with the original large offset.

This change replaces the manual bounds and overflow checks in the
applyRelocations* functions with calls to saferio.{InBounds32,InBounds64}.

These helper functions centralize the logic for validating slice access,
correctly handling both out-of-bounds and integer overflow conditions.
This simplifies the relocation code and improves robustness when parsing
malformed ELF files.

Fixes #75516

gopherbot · 2025-09-18T12:51:57Z

This PR (HEAD: c6b2f25) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-18T13:01:23Z

Message from Gopher Robot:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T13:10:34Z

Message from Jes Cok:

Patch Set 1: Commit-Queue+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T13:10:34Z

Message from Go LUCI:

Patch Set 1:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2025-09-18T12:57:12Z","revision":"7d200899dd12d3e825e9b67bbc3c1ac0597e3dd9"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T13:28:41Z

Message from Jes Cok:

Patch Set 1: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T13:28:42Z

Message from Go LUCI:

Patch Set 1:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T13:28:42Z

Message from Go LUCI:

Patch Set 1: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-18T17:42:54Z

Message from Ian Lance Taylor:

Patch Set 1:

(2 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T10:34:02Z

Message from Jes Cok:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T14:40:15Z

This PR (HEAD: 656e01b) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-19T14:57:25Z

This PR (HEAD: b7aca22) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-19T15:24:09Z

This PR (HEAD: 7f9310d) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-19T16:41:28Z

Message from Jes Cok:

Patch Set 4: Commit-Queue+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T16:41:29Z

Message from Go LUCI:

Patch Set 4:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2025-09-19T16:32:17Z","revision":"37119c7b9e761a92178f3f921cdff99ad3b76e20"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T17:06:51Z

Message from Ian Lance Taylor:

Patch Set 4:

(2 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T17:06:51Z

Message from Jes Cok:

Patch Set 4: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T17:06:52Z

Message from Go LUCI:

Patch Set 4:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T17:06:52Z

Message from Go LUCI:

Patch Set 4: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

When applying relocations, a malformed ELF file can provide an offset that, when added to the relocation size, overflows. This wrapped-around value could then incorrectly pass the bounds check, leading to a panic when the slice is accessed with the original large offset. This change replaces the manual bounds and overflow checks in the applyRelocations* functions with calls to saferio.{InBounds32,InBounds64}. These helper functions centralize the logic for validating slice access, correctly handling both out-of-bounds and integer overflow conditions. This simplifies the relocation code and improves robustness when parsing untrusted ELF files. Fixes golang#75516 Change-Id: I3a1662398a981977d6cbacfa47c40707ddd87b37

Change-Id: Ibe088dacbb128dee4de8f45687950210e213ea9b

Change-Id: I7a2b6879e1d124d0dbb5b481adf3570d549f0644

Change-Id: I118c6fea5373028ded3447f70e37914ee1ad5cf5

Change-Id: I98e5f9c93978337d0a5be5e9c7209c51d7dcb220

Change-Id: Ifd90041cd22315ef6004eca4aa4d13df01c6c747

gopherbot · 2025-09-19T18:07:45Z

This PR (HEAD: 40ef3a0) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

Change-Id: I1b554d310af43cf376e99468d3cf6db515e8a180

gopherbot · 2025-09-19T18:24:38Z

This PR (HEAD: aaa4f90) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-19T18:32:53Z

Message from Jes Cok:

Patch Set 6: Commit-Queue+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T18:32:53Z

Message from Go LUCI:

Patch Set 6:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2025-09-19T18:26:33Z","revision":"7c8e9a7d138d324cce28f80c5d434dc7dc736724"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T18:49:47Z

Message from Jes Cok:

Patch Set 6: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T18:49:48Z

Message from Go LUCI:

Patch Set 6:

This CL has failed the run. Reason:

Tryjob golang/try/gotip-linux-386_debiansid has failed with summary (view all results):

go on master (change 705075)

To reproduce, try gomote repro 8703275823735374721.

Additional links for debugging:

go tool dist test -json output [shard 2]

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T18:49:48Z

Message from Go LUCI:

Patch Set 6: LUCI-TryBot-Result-1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

Change-Id: I5a046df365cc4ead67e1848961b02a7176ccbfef

Change-Id: I6b62776d43e3c71ac8577a89c479a56de93b3183

gopherbot · 2025-09-19T18:58:15Z

This PR (HEAD: 3ec0cfc) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-19T19:15:02Z

Message from Jes Cok:

Patch Set 7: Commit-Queue+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T19:23:22Z

Message from Go LUCI:

Patch Set 7:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2025-09-19T19:04:55Z","revision":"d4b8845e9560bf9ffba8e218992de3f3e8617d70"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T19:31:43Z

Message from Jes Cok:

Patch Set 7: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T19:31:43Z

Message from Go LUCI:

Patch Set 7:

This CL has failed the run. Reason:

Tryjob golang/try/gotip-linux-386_debiansid has failed with summary (view all results):

go on master (change 705075)

To reproduce, try gomote repro 8703273403915967825.

Additional links for debugging:

go tool dist test -json output [shard 3]

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-19T19:31:44Z

Message from Go LUCI:

Patch Set 7: LUCI-TryBot-Result-1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

Change-Id: Id646b08cdad75fa9ab1d61a3ad11c17fa77f0ace

gopherbot · 2025-09-19T19:56:28Z

This PR (HEAD: a7ce104) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/705075.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2025-09-20T02:30:52Z

Message from Jes Cok:

Patch Set 8: Commit-Queue+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-20T02:30:52Z

Message from Go LUCI:

Patch Set 8:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2025-09-20T02:19:42Z","revision":"8b100ca8399b8b5e02b0d743621539792907156c"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-20T02:45:35Z

Message from Jes Cok:

Patch Set 8: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-20T02:45:35Z

Message from Go LUCI:

Patch Set 8:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2025-09-20T02:45:36Z

Message from Go LUCI:

Patch Set 8: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/705075.
After addressing review feedback, remember to publish your drafts!

austinderek mentioned this pull request Sep 18, 2025

debug/elf: prevent out-of-bounds access in applyRelocations PullRequestInc/go#80

Open

callthingsoff force-pushed the elf_range_check branch from c6b2f25 to 656e01b Compare September 19, 2025 14:39

callthingsoff changed the title ~~debug/elf: prevent out-of-bounds access in applyRelocations~~ debug/elf: use saferio.InBounds to prevent offset overflow Sep 19, 2025

callthingsoff force-pushed the elf_range_check branch from 656e01b to b3c1976 Compare September 19, 2025 14:43

callthingsoff added 6 commits September 20, 2025 02:04

2

4faa6d6

Change-Id: Ibe088dacbb128dee4de8f45687950210e213ea9b

3

de7f2e0

Change-Id: I7a2b6879e1d124d0dbb5b481adf3570d549f0644

4

af01062

Change-Id: I118c6fea5373028ded3447f70e37914ee1ad5cf5

5

32e8936

Change-Id: I98e5f9c93978337d0a5be5e9c7209c51d7dcb220

6

40ef3a0

Change-Id: Ifd90041cd22315ef6004eca4aa4d13df01c6c747

callthingsoff force-pushed the elf_range_check branch from 7f9310d to 40ef3a0 Compare September 19, 2025 18:04

7

aaa4f90

Change-Id: I1b554d310af43cf376e99468d3cf6db515e8a180

callthingsoff added 2 commits September 20, 2025 02:50

8

a9acbe6

Change-Id: I5a046df365cc4ead67e1848961b02a7176ccbfef

9

3ec0cfc

Change-Id: I6b62776d43e3c71ac8577a89c479a56de93b3183

10

a7ce104

Change-Id: Id646b08cdad75fa9ab1d61a3ad11c17fa77f0ace

debug/elf: use saferio.InBounds to prevent offset overflow #75522

Are you sure you want to change the base?

debug/elf: use saferio.InBounds to prevent offset overflow #75522

Conversation

callthingsoff commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 18, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 19, 2025

Uh oh!

gopherbot commented Sep 20, 2025

Uh oh!

gopherbot commented Sep 20, 2025

Uh oh!

gopherbot commented Sep 20, 2025

Uh oh!

gopherbot commented Sep 20, 2025

Uh oh!

gopherbot commented Sep 20, 2025

callthingsoff commented Sep 18, 2025 •

edited

Loading