From 533dfc82fd228bfadf42ea7180c39de7d9af47fa Mon Sep 17 00:00:00 2001 From: Dylan Reimerink Date: Wed, 27 May 2026 14:05:06 +0200 Subject: [PATCH] btf: Fixed integer overflow in length checking Fuzzing revealed that a bad ELF file could cause an integer overflow when doing a bounds check. Fixed this by casting two uint32 values to uint64 before adding them together. Signed-off-by: Dylan Reimerink --- btf/btf.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/btf/btf.go b/btf/btf.go index cdc95425f..a9160c678 100644 --- a/btf/btf.go +++ b/btf/btf.go @@ -214,7 +214,7 @@ func loadRawSpec(btf []byte, base *Spec) (*Spec, error) { } btf = btf[header.HdrLen:] - if int(header.StringOff+header.StringLen) > len(btf) { + if uint64(header.StringOff)+uint64(header.StringLen) > uint64(len(btf)) { return nil, fmt.Errorf("string table is out of bounds") } stringsSection := btf[header.StringOff : header.StringOff+header.StringLen] @@ -224,7 +224,7 @@ func loadRawSpec(btf []byte, base *Spec) (*Spec, error) { return nil, fmt.Errorf("read string section: %w", err) } - if int(header.TypeOff+header.TypeLen) > len(btf) { + if uint64(header.TypeOff)+uint64(header.TypeLen) > uint64(len(btf)) { return nil, fmt.Errorf("types section is out of bounds") } typesSection := btf[header.TypeOff : header.TypeOff+header.TypeLen]