[dayatsin-amd]

Summary

Backport of ROCm/rocm-systems#9031 onto release/rocm-rel-6.4.2.2.

Hardens the ROCr ELF code-object loader against out-of-bounds heap reads driven by attacker-controlled section and symbol indices when parsing untrusted code objects (SWSPLAT-45972). GElfImage::section() indexed the sections vector with unvalidated sh_link, sh_info, and st_shndx fields, and GElfSymbolTable::symbol() indexed the symbols vector with the unvalidated relocation r_info symbol index.

• section() / symbol() / getStringTable() reject out-of-range indices, and string/symbol-table lookups also reject an in-range section of the wrong type.
• GElfSymbol::section() rejects reserved indices (>= SHN_LORESERVE).
• pullData() fails the code object when the referenced string, symbol, or target section is invalid. sh_info == 0 remains valid for dynamic relocation sections.
• executable.cpp null-checks GetSection() / section() / symbol() in LoadDefinitionSymbol, both SymbolAddress overloads, ApplyStaticRelocation, and ApplyDynamicRelocation.

The elf::Symbol* SymbolAddress null check is already present on develop and was missing on this branch, so it is included here.

JIRA ID : SWSPLAT-45972

Test plan

• Change matches the merged develop fix in rocm-systems#9031, adapted to the 6.4.2.2 loader (that fix was verified on gfx1100: valid code objects still load, and the six crafted index cases return HSA_STATUS_ERROR_INVALID_CODE_OBJECT instead of SIGSEGV).
• Rebuild libhsa-runtime64 from this branch and reload a well-formed code object (with and without dynamic relocations).
• Reload the crafted sh_link / sh_info / st_shndx / r_info objects and confirm HSA_STATUS_ERROR_INVALID_CODE_OBJECT instead of a crash.

Made with Cursor