debug/elf: index out of range in NewFile

[catenacyber]

Go version

go 1.23 and go dev branch on playground

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/root/.go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/root/.go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.1'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='1'
GOMOD='/src/ngolo-fuzzing/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3117429358=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Found by ngolo-fuzzing https://issues.oss-fuzz.com/u/1/issues/380938361?pli=1 (long time no new bugs)

Run https://go.dev/play/p/1u2ww_IpvI2

What did you see happen?

panic: runtime error: index out of range [3] with length 0

goroutine 1 [running]:
encoding/binary.littleEndian.Uint32(...)
/usr/local/go-faketime/src/encoding/binary/binary.go:87
debug/elf.NewFile({0x502688, 0xc000016180})
/usr/local/go-faketime/src/debug/elf/file.go:520 +0x2775
main.main()
/tmp/sandbox3298571712/prog.go:12 +0x94

Program exited.

What did you expect to see?

As in go 1.22 : no panic and

Hello, 世界

Program exited.

[gabyhelp]

Related Issues

• debug/buildinfo: index out of range in buildinfo.Read #58137 (closed)
• debug/elf: slice bounds out of range in Symbols #62649 (closed)
• debug/elf: slice out of bounds in DynValue #64446 (closed)
• debug/elf: slice out of bounds in ImportedLibraries #63610 (closed)
• debug/elf: panic: runtime error: slice bounds out of range #52035 (closed)
• debug/buildinfo: index out of range in buildinfo.Read #57002 (closed)
• debug/buildinfo: slice bounds out of range #69066 (closed)
• cmd/link/internal/loader: panic: runtime error: index out of range [1232602353] with length 116 #69214 (closed)
• debug/pe: index out of range in COFFSymbolReadSectionDefAux #52525 (closed)
• index/suffixarray: panic: runtime error: index out of range #53352

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/632035 mentions this issue: debug/elf: check for multiplication overflow for shnum * shentsize

[GoVeronicaGo]

The fix is ready to be submitted. https://go.dev/cl/632035