Skip to content

ElfCoreDump is not respecting 4-byte padding between Note entries #48

@dedmen

Description

@dedmen

https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-18048.html

Padding is present, if necessary, to ensure 4-byte alignment for the descriptor. Such padding is not included in namesz.

Thats done correctly here with NameSize:

int nameEnd = reader.Position + (int)note.NameSize;

But the 4-byte padding to the next note is not considered.

The first descsz bytes in desc hold the note descriptor. If no descriptor is present, descsz contains the value zero. Padding is present, if necessary, to ensure 4-byte alignment for the next note entry. Such padding is not included in descsz.

descsz also needs to be 4 byte padded same as name.

Ghetto fix

string name = reader.ReadString();
reader.Position = nameEnd;
byte[] content = reader.ReadBlock(note.n_descsz);

                            string name = reader.ReadString();
                            reader.Position = nameEnd;
                            int descEnd = reader.Position + (int)note.DescSizeWithPadding;
                            byte[] content = reader.ReadBlock(note.n_descsz);
                            reader.Position = descEnd;

Will make a pull request someday when I get the time for it

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions