This article describes an interesting overflow bug in the ELF hash function.
The System V Application Binary Interface (generic ABI) specifies the
ELF object file format. When producing an executable or shared object
file needing a dynamic symbol table (.dynsym
), a linker
generates a .hash
section with type SHT_HASH
to hold a symbol
hash table. A DT_HASH
tag is produced to hold the
address of .hash
.
The hash table is used by a dynamic loader to perform symbol lookup
(for dynamic relocations and dlsym
family functions). A
detailed description of the format can be found in ELF: symbol lookup via
DT_HASH
.