From f05bc8f59b01c605273ab9736585218d9ecc510c Mon Sep 17 00:00:00 2001
From: liujian <liujianliu.liu@huawei.com>
Date: Mon, 31 May 2021 22:32:37 +0800
Subject: [PATCH] bash-4.0-nobits

---
 execute_cmd.c | 111 ++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 107 insertions(+), 4 deletions(-)

diff --git a/execute_cmd.c b/execute_cmd.c
index 374843d..99674df 100644
--- a/execute_cmd.c
+++ b/execute_cmd.c
@@ -5875,6 +5875,7 @@ shell_execve (command, args, env)
 	      && memcmp (sample, ELFMAG, SELFMAG) == 0)
 	    {
 	      off_t offset = -1;
+              int dynamic_nobits = 0;
 
 	      /* It is an ELF file.  Now determine whether it is dynamically
 		 linked and if yes, get the offset of the interpreter
@@ -5884,13 +5885,61 @@ shell_execve (command, args, env)
 		{
 		  Elf32_Ehdr ehdr;
 		  Elf32_Phdr *phdr;
-		  int nphdr;
+                  Elf32_Shdr *shdr;
+		  int nphdr, nshdr;
 
 		  /* We have to copy the data since the sample buffer
 		     might not be aligned correctly to be accessed as
 		     an Elf32_Ehdr struct.  */
 		  memcpy (&ehdr, sample, sizeof (Elf32_Ehdr));
 
+		  nshdr = ehdr.e_shnum;
+		  shdr = (Elf32_Shdr *) malloc (nshdr * ehdr.e_shentsize);
+                  
+		  if (shdr != NULL)
+		    {
+#ifdef HAVE_PREAD
+		      sample_len = pread (fd, shdr, nshdr * ehdr.e_shentsize,
+					  ehdr.e_shoff);
+#else
+		      if (lseek (fd, ehdr.e_shoff, SEEK_SET) != -1)
+			sample_len = read (fd, shdr,
+					   nshdr * ehdr.e_shentsize);
+		      else
+			sample_len = -1;
+#endif
+		      if (sample_len == nshdr * ehdr.e_shentsize)
+                        {
+                          char *strings = (char *) malloc (shdr[ehdr.e_shstrndx].sh_size);
+                          if (strings != NULL)
+                            {
+#ifdef HAVE_PREAD
+		              sample_len = pread (fd, strings,
+                                             shdr[ehdr.e_shstrndx].sh_size,
+					     shdr[ehdr.e_shstrndx].sh_offset);
+#else
+		              if (lseek (fd, shdr[ehdr.e_shstrndx].sh_offset,
+                                         SEEK_SET) != -1)
+			        sample_len = read (fd, strings,
+			  		       shdr[ehdr.e_shstrndx].sh_size);
+		              else
+			        sample_len = -1;
+#endif
+                              if (sample_len == shdr[ehdr.e_shstrndx].sh_size)
+			        while (nshdr-- > 0)
+                                  if (strcmp (strings + shdr[nshdr].sh_name,
+                                              ".interp") == 0 &&
+                                      shdr[nshdr].sh_type == SHT_NOBITS)
+                                    {
+                                      dynamic_nobits++;
+                                      break;
+                                    }
+                              free (strings);
+                            }
+                        }
+		      free (shdr);
+		    }
+
 		  nphdr = ehdr.e_phnum;
 		  phdr = (Elf32_Phdr *) malloc (nphdr * ehdr.e_phentsize);
 		  if (phdr != NULL)
@@ -5920,13 +5969,60 @@ shell_execve (command, args, env)
 		{
 		  Elf64_Ehdr ehdr;
 		  Elf64_Phdr *phdr;
-		  int nphdr;
+                  Elf64_Shdr *shdr;
+		  int nphdr, nshdr;
 
 		  /* We have to copy the data since the sample buffer
 		     might not be aligned correctly to be accessed as
 		     an Elf64_Ehdr struct.  */
 		  memcpy (&ehdr, sample, sizeof (Elf64_Ehdr));
 
+		  nshdr = ehdr.e_shnum;
+		  shdr = (Elf64_Shdr *) malloc (nshdr * ehdr.e_shentsize);
+		  if (shdr != NULL)
+		    {
+#ifdef HAVE_PREAD
+		      sample_len = pread (fd, shdr, nshdr * ehdr.e_shentsize,
+					  ehdr.e_shoff);
+#else
+		      if (lseek (fd, ehdr.e_shoff, SEEK_SET) != -1)
+			sample_len = read (fd, shdr,
+					   nshdr * ehdr.e_shentsize);
+		      else
+			sample_len = -1;
+#endif
+		      if (sample_len == nshdr * ehdr.e_shentsize)
+                        {
+                          char *strings = (char *) malloc (shdr[ehdr.e_shstrndx].sh_size);
+                          if (strings != NULL)
+                            {
+#ifdef HAVE_PREAD
+		              sample_len = pread (fd, strings,
+                                             shdr[ehdr.e_shstrndx].sh_size,
+					     shdr[ehdr.e_shstrndx].sh_offset);
+#else
+		              if (lseek (fd, shdr[ehdr.e_shstrndx].sh_offset,
+                                         SEEK_SET) != -1)
+			        sample_len = read (fd, strings,
+			  		       shdr[ehdr.e_shstrndx].sh_size);
+		              else
+			        sample_len = -1;
+#endif
+                              if (sample_len == shdr[ehdr.e_shstrndx].sh_size)
+			        while (nshdr-- > 0)
+                                  if (strcmp (strings + shdr[nshdr].sh_name,
+                                              ".interp") == 0 &&
+                                      shdr[nshdr].sh_type == SHT_NOBITS)
+                                    {
+                                      dynamic_nobits++;
+                                      break;
+                                    }
+                              free (strings);
+                            }
+                        }
+		      free (shdr);
+		    }
+
 		  nphdr = ehdr.e_phnum;
 		  phdr = (Elf64_Phdr *) malloc (nphdr * ehdr.e_phentsize);
 		  if (phdr != NULL)
@@ -5986,8 +6082,15 @@ shell_execve (command, args, env)
 		    {
 		      close (fd);
 		      errno = i;
-		      sys_error ("%s: %s: bad ELF interpreter", command,
-				 interp);
+                      if (dynamic_nobits > 0)
+                        {
+                          sys_error ("%s: bad ELF interpreter", command);
+                        }
+                      else
+                        {
+		          sys_error ("%s: %s: bad ELF interpreter", command,
+				     interp);
+                        }
 		      free (interp);
 		      return (EX_NOEXEC);
 		    }
-- 
2.23.0