From 0ee0da46079d4e9453afe2b28acdaadc0f011042 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Mon, 10 Aug 2026 11:20:13 -0400 Subject: [PATCH] libbpf: avoid overflow in BTF.ext bounds check An invalid BTF.ext subsection length can wrap the pointer addition used by btf_ext_parse_sec_info() on 32-bit builds. The wrapped pointer passes the bounds check and parsing then reads beyond the copied BTF.ext data. Validate the offset and length with subtraction before forming the section pointer. Add a selftest using an overflowing func_info_len. Fixes: cf579164e9ea ("libbpf: Support BTF.ext loading and output in either endianness") Closes: https://issues.oss-fuzz.com/issues/477315119 Signed-off-by: Darren Carreras --- tools/lib/bpf/btf.c. | 13 +++++----- .../selftests/bpf/prog_tests/test_btf_ext.c. | 24 +++++++++++++++++++ 2 files changed, 31 insertions(+), 6 deletions(-) diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c index 8417de92d..744f33e2a 100644 --- a/tools/lib/bpf/btf.c +++ b/tools/lib/bpf/btf.c @@ -3364,7 +3364,7 @@ static