Skip to content

Mach-O LC_SYMTAB parsing emits "Weird" messages for empty tables #1325

@liamwhite

Description

@liamwhite

Describe the bug
For kernelcollections files like the x86_64 BootKernelExtensions.kc, there is an empty symtab load command which is intended to be consumed by boot.efi:

Load command 3
     cmd LC_SYMTAB
 cmdsize 24
  symoff 0
   nsyms 0
  stroff 0
 strsize 0

Because symoff and stroff are set to 0 (even though nsyms is also 0, so there isn't any place to put them anyway), LIEF emits "Weird" messages from here:

LIEF_WARN("Weird: LC_SYMTAB.n_list is not in the __LINKEDIT segment");
}
}
/* strtable */ {
span<uint8_t> content = strings_linkedit->content();
const uint64_t rel_offset =
cmd.strings_offset() - strings_linkedit->file_offset();
const size_t strtab_size = cmd.strings_size();
if (rel_offset > content.size() || (rel_offset + strtab_size) > content.size())
{
LIEF_ERR("The LC_SYMTAB.strtab is out of bounds of the segment {}",
strings_linkedit->name());
return make_error_code(lief_errors::read_out_of_bound);
}
cmd.string_table_ = content.subspan(rel_offset, strtab_size);
if (LinkEdit::segmentof(*strings_linkedit)) {
static_cast<LinkEdit*>(strings_linkedit)->symtab_ = &cmd;
} else {
LIEF_WARN("Weird: LC_SYMTAB.strtab is not in the __LINKEDIT segment");

To Reproduce
Parse the x86_64 BootKernelExtensions.kc file.

Expected behavior
No "Weird" messages should print.

Environment (please complete the following information):

  • System and Version: Fedora 43
  • Target format: Mach-O
  • LIEF commit version: 0.17.3-03aca30b

Additional context
As far as I can tell, there isn't a rule in the Mach-O format that says that symtab or dysymtab even have to be in the LINKEDIT segment, so this is probably just a more general case of what's happening in #1307

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions