Skip to content

Fix out-of-bounds read in objdump reloc section handling#2691

Open
sumleo wants to merge 1 commit intoWebAssembly:mainfrom
sumleo:fix/objdump-reloc-oob-read
Open

Fix out-of-bounds read in objdump reloc section handling#2691
sumleo wants to merge 1 commit intoWebAssembly:mainfrom
sumleo:fix/objdump-reloc-oob-read

Conversation

@sumleo
Copy link
Contributor

@sumleo sumleo commented Feb 12, 2026

Summary

  • BinaryReaderObjdump::OnRelocCount ignored the error returned by BinaryReaderObjdumpBase::OnRelocCount when the section_index was invalid, causing it to proceed to GetSectionNameGetSectionStart with BinarySection::Invalid (~0), resulting in an out-of-bounds read on the stack-allocated section_starts_ array of size kBinarySectionCount (14).
  • Propagate the error via CHECK_RESULT so the out-of-bounds access is never reached.
  • Add a regression test with a crafted wasm binary containing a reloc custom section that references a non-existent section index.

Details

In binary-reader-objdump.cc, BinaryReaderObjdump::OnRelocCount calls the base class method but discards its return value:

Result BinaryReaderObjdump::OnRelocCount(Index count, Index section_index) {
  BinaryReaderObjdumpBase::OnRelocCount(count, section_index); // return value ignored
  PrintDetails("  - relocations for section: %d (%s) [%d]\n",
               section_index,
               GetSectionName(section_index),  // OOB read here
               count);
  return Result::Ok;
}

The base class returns Result::Error for out-of-range indices and sets reloc_section_ = BinarySection::Invalid. GetSectionName then calls GetSectionStart(BinarySection::Invalid) which indexes section_starts_[~0] — far past the 14-element array.

Test plan

  • New test BinaryReaderObjdump.RelocInvalidSectionIndex exercises the fix with a crafted wasm binary
  • All existing unit tests pass (128 tests)

@sumleo sumleo force-pushed the fix/objdump-reloc-oob-read branch from 46086b3 to 796adde Compare February 12, 2026 08:47
BinaryReaderObjdump::OnRelocCount ignored the error returned by
BinaryReaderObjdumpBase::OnRelocCount when the section_index was
invalid. This caused the function to proceed to GetSectionName which
called GetSectionStart with BinarySection::Invalid (~0), resulting in
an out-of-bounds read on the stack-allocated section_starts_ array of
size kBinarySectionCount (14).

Propagate the error via CHECK_RESULT so that the out-of-bounds access
is never reached.

Add a regression test with a crafted wasm binary containing a reloc
custom section that references a non-existent section index.
@sumleo sumleo force-pushed the fix/objdump-reloc-oob-read branch from 796adde to ee56af2 Compare February 12, 2026 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant