From 9961f6629d56a13958818067d89f25d40019eddd Mon Sep 17 00:00:00 2001
From: Romain Thomas <me@romainthomas.fr>
Date: Sat, 28 Oct 2023 15:09:15 +0200
Subject: [PATCH] Resolve 984

---
 src/ELF/Parser.cpp       | 14 ++++++++++++--
 tests/elf/test_parser.py |  4 ++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/ELF/Parser.cpp b/src/ELF/Parser.cpp
index 4b5ef17eee..17749e2d7f 100644
--- a/src/ELF/Parser.cpp
+++ b/src/ELF/Parser.cpp
@@ -205,8 +205,9 @@ bool Parser::should_swap() const {
 
 
 ELF_CLASS determine_elf_class(BinaryStream& stream) {
-  ELF_CLASS from_ei_class  = ELF_CLASS::ELFCLASSNONE;
-  ELF_CLASS from_e_machine = ELF_CLASS::ELFCLASSNONE;
+  auto from_ei_class  = ELF_CLASS::ELFCLASSNONE;
+  auto from_e_machine = ELF_CLASS::ELFCLASSNONE;
+  auto file_type = E_TYPE::ET_NONE;
 
   // First, check EI_CLASS
   if (auto res = stream.peek<Header::identity_t>()) {
@@ -218,6 +219,11 @@ ELF_CLASS determine_elf_class(BinaryStream& stream) {
     }
   }
 
+  constexpr size_t e_type_off = offsetof(details::Elf32_Ehdr, e_type);
+  if (auto res = stream.peek<uint16_t>(e_type_off)) {
+    file_type = static_cast<E_TYPE>(*res);
+  }
+
   // Try to determine the size based on Elf_Ehdr.e_machine
   //
   // typedef struct {
@@ -261,6 +267,10 @@ ELF_CLASS determine_elf_class(BinaryStream& stream) {
       return from_ei_class;
     }
 
+    if (file_type == E_TYPE::ET_REL) {
+      return from_ei_class;
+    }
+
     LIEF_WARN("ELF class from machine type ('{}') does not match ELF class from "
               "e_ident ('{}'). The binary has been likely modified.",
               to_string(from_e_machine), to_string(from_ei_class));
diff --git a/tests/elf/test_parser.py b/tests/elf/test_parser.py
index aa944a721e..e6e3c14251 100644
--- a/tests/elf/test_parser.py
+++ b/tests/elf/test_parser.py
@@ -131,3 +131,7 @@ class Wrong:
 
 def test_path_like():
     assert lief.ELF.parse(Path(get_sample('ELF/test_897.elf'))) is not None
+
+def test_984():
+    elf = lief.ELF.parse(get_sample('ELF/issue_984_ilp32.o'))
+    assert len(elf.sections) > 0