From ea7165a17a2f947c5f3d9e9f149157182e6fba2c Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Thu, 3 Sep 2026 09:07:32 -0400 Subject: [PATCH] Reject overflowing ELF section ranges --- rpcs3/Loader/ELF.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rpcs3/Loader/ELF.h b/rpcs3/Loader/ELF.h index bb0db4c86c33..b19b9e452a02 100644 --- a/rpcs3/Loader/ELF.h +++ b/rpcs3/Loader/ELF.h @@ -373,7 +373,9 @@ class elf_object // Try to find it in phdr data instead of allocating new section p_index++; - if (hdr.p_offset <= shdr.sh_offset && shdr.sh_offset + shdr.sh_size <= hdr.p_offset + hdr.p_filesz) + if (hdr.p_offset <= shdr.sh_offset && + shdr.sh_size <= hdr.p_filesz && + shdr.sh_offset - hdr.p_offset <= hdr.p_filesz - shdr.sh_size) { const auto& prog = ::at32(progs, p_index); shdrs.back().bin_view = {prog.bin.data() + shdr.sh_offset - hdr.p_offset, shdr.sh_size}; @@ -469,7 +471,9 @@ class elf_object p_index++; // Rely on previous sh_offset value! - if (hdr.p_offset <= shdr.sh_offset && shdr.sh_offset + shdr.sh_size - 1 <= hdr.p_offset + hdr.p_filesz - 1) + if (hdr.p_offset <= shdr.sh_offset && + shdr.sh_size <= hdr.p_filesz && + shdr.sh_offset - hdr.p_offset <= hdr.p_filesz - shdr.sh_size) { out.sh_offset = ::narrow(data_base + static_cast(shdr.sh_offset - hdr.p_offset)); result = true;