Skip to content

fix: elffile: skip unreadable dynamic symbol names instead of aborting - #3210

Merged
williballenthin merged 1 commit into
mandiant:masterfrom
Henglie:fix/elf-invalid-utf8-symbol-names
Oct 30, 2026
Merged

williballenthin merged 1 commit into
mandiant:masterfrom
Henglie:fix/elf-invalid-utf8-symbol-names

Conversation

@Henglie

@Henglie Henglie commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Closes #3207

Root cause

When an ELF has no section headers, pyelftools resolves dynamic symbol names through _DynamicStringTable.get_string, which decodes strictly as UTF-8. A single invalid byte raises UnicodeDecodeError, and capa's extractor did not catch it, so the whole run aborted.

Fix

Dynamic symbol reads now go through iter_dynamic_symbols, which catches UnicodeDecodeError from both num_symbols() and get_symbol() and skips unreadable entries instead of terminating. It yields the original symbol index alongside each symbol so import-to-symbol mapping remains correct after a skip. get_relocation_tables() is guarded the same way because DT_NEEDED-family tags use the same strict decode path.

Validation

  • python -m pytest tests/test_elffile_features.py tests/test_elf_os_detection.py -q -> 173 passed
  • New regression test_elffile_invalid_utf8_dynamic_symbol_name synthesizes a section-header-less ELF with a 0xff symbol name followed by a valid good symbol, and asserts extraction still completes and yields the format plus the readable export.
  • The regression fails on current master with the reported UnicodeDecodeError and passes with this branch.

[x] No CHANGELOG update needed

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

@github-actions
github-actions Bot dismissed their stale review October 30, 2026 01:04

CHANGELOG updated or no update needed, thanks! 😄

@williballenthin williballenthin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @Henglie!

@williballenthin
williballenthin merged commit 0024019 into mandiant:master Oct 30, 2026
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

elffile: crash with UnicodeDecodeError when the dynamic string table contains non-UTF-8 bytes and the ELF has no section headers

2 participants