docs: document entry-size, command-count, and numeric-field bounds
ober
707d8207bd994b3660eb1c710c072b1c09ec9e39
--- a/docs/parser-hardening.md +++ b/docs/parser-hardening.md @@ -8,16 +8,25 @@ commands as hostile. - `JASM_MAX_INPUT_BYTES` limits file reads. The default is 64 MiB. - `JASM_MAX_HEX_CHARS` limits raw CLI hex input. The default is 16 MiB. - ELF section headers must meet the minimum entry size for the selected class. +- ELF symbol and relocation tables must meet the minimum entry size for their + section type and class (Sym/Rel/Rela sizes); undersized entry sizes are + rejected before any per-entry allocation. - Mach-O load commands must be at least 8 bytes, segment commands must be at least 72 bytes, and declared sections must fit inside the load command. +- Mach-O `ncmds` is bounded by `sizeofcmds / 8`, and the symtab `nsyms` must + fit inside the file (`symoff + nsyms * 16 <= len`) before the symbol loop. - Unix archive BSD long-name records must have numeric, non-negative name lengths that fit within the member size. +- Unix archive numeric fields must be exact, non-negative integers; rationals + and flonums are rejected. ## Regression Coverage `tests/test-malformed-objects.ss` covers malformed hex, truncated ELF/COFF, -zero-sized Mach-O commands, Mach-O segment section overruns, and invalid archive -BSD long-name sizes. +undersized ELF section-header and symbol/relocation entry sizes, zero-sized +Mach-O commands, Mach-O segment section overruns, Mach-O command-count and +symtab-count overruns, invalid archive BSD long-name sizes, and non-integer +archive size fields. `make object-fuzz-evidence` adds deterministic malformed-object parser soak: