diff options
| author | Mark Wielaard <mjw@redhat.com> | 2015-05-08 17:56:32 +0200 |
|---|---|---|
| committer | Mark Wielaard <mjw@redhat.com> | 2015-05-13 16:31:52 +0200 |
| commit | a2b964c7dbbf54162b2c50931c172568fb4cfa70 (patch) | |
| tree | e8c3061ff4e211b41701acd574360b729f3f6f9d | |
| parent | f0855403012fe34aee248353e4435d0b5c6576ef (diff) | |
| download | elfutils-a2b964c7dbbf54162b2c50931c172568fb4cfa70.tar.gz | |
Always call gelf_fsize with EV_CURRENT as argument.
Don't trust the elf version given by the file. It could be completely
bogus. In which case gelf_fsize just returns zero. Which could cause
divide by zero errors.
https://bugzilla.redhat.com/show_bug.cgi?id=1170810#c34
Signed-off-by: Mark Wielaard <mjw@redhat.com>
| -rw-r--r-- | libelf/ChangeLog | 4 | ||||
| -rw-r--r-- | libelf/nlist.c | 2 | ||||
| -rw-r--r-- | src/ChangeLog | 5 | ||||
| -rw-r--r-- | src/nm.c | 2 | ||||
| -rw-r--r-- | src/strip.c | 19 |
5 files changed, 18 insertions, 14 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e9c2a8de..312d5cfb 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,7 @@ +2015-05-08 Mark Wielaard <mjw@redhat.com> + + * nlist.c (nlist): Call gelf_fsize with EV_CURRENT. + 2015-01-03 Mark Wielaard <mjw@redhat.com> * version_xlate.h (elf_cvt_Verdef): Use memmove to copy src to dest. diff --git a/libelf/nlist.c b/libelf/nlist.c index 41e5ff64..89fd0819 100644 --- a/libelf/nlist.c +++ b/libelf/nlist.c @@ -126,7 +126,7 @@ nlist (const char *filename, struct nlist *nl) /* How many symbols are there? */ nsyms = (shdr->sh_size - / INTUSE(gelf_fsize) (elf, ELF_T_SYM, 1, data->d_version)); + / INTUSE(gelf_fsize) (elf, ELF_T_SYM, 1, EV_CURRENT)); /* Create the hash table. */ table = nlist_fshash_init (nsyms); diff --git a/src/ChangeLog b/src/ChangeLog index e79f457c..55bd4ccf 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,8 @@ +2015-05-08 Mark Wielaard <mjw@redhat.com> + + * nm.c (show_symbols): Call gelf_fsize with EV_CURRENT. + * strip.c (handle_elf): Likewise. + 2015-05-06 Mark Wielaard <mjw@redhat.com> * elflint.c (check_gnu_hash): Return early when 2nd hash function @@ -1166,7 +1166,7 @@ show_symbols (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, Elf_Scn *xndxscn, /* Consistency checks. */ if (entsize == 0 - || entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, ehdr->e_version)) + || entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT)) error (0, 0, gettext ("%s: entry size in section %zd `%s' is not what we expect"), fullname, elf_ndxscn (scn), diff --git a/src/strip.c b/src/strip.c index fd3920dd..365b18dd 100644 --- a/src/strip.c +++ b/src/strip.c @@ -810,8 +810,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, /* Go through all symbols and make sure the section they reference is not removed. */ - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT); for (size_t inner = 0; inner < shdr_info[cnt].data->d_size / elsize; @@ -1193,8 +1192,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf_Data *versiondata = NULL; Elf_Data *shndxdata = NULL; - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT); if (shdr_info[cnt].symtab_idx != 0) { @@ -1487,8 +1485,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf32_Word *bucket = (Elf32_Word *) hashd->d_buf; size_t strshndx = shdr_info[symtabidx].old_sh_link; - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT); /* Adjust the nchain value. The symbol table size changed. We keep the same size for the bucket array. */ @@ -1541,8 +1538,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf; size_t strshndx = shdr_info[symtabidx].old_sh_link; - size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, ELF_T_SYM, 1, EV_CURRENT); /* Adjust the nchain value. The symbol table size changed. We keep the same size for the bucket array. */ @@ -1611,8 +1607,7 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, GElf_Half *verstab = (GElf_Half *) verd->d_buf; /* Walk through the list and */ - size_t elsize = gelf_fsize (elf, verd->d_type, 1, - ehdr->e_version); + size_t elsize = gelf_fsize (elf, verd->d_type, 1, EV_CURRENT); for (size_t inner = 1; inner < verd->d_size / elsize; ++inner) if (newsymidx[inner] != 0) /* Overwriting the same array works since the @@ -1624,8 +1619,8 @@ handle_elf (int fd, Elf *elf, const char *prefix, const char *fname, verd->d_size = gelf_fsize (newelf, verd->d_type, symd->d_size / gelf_fsize (elf, symd->d_type, 1, - ehdr->e_version), - ehdr->e_version); + EV_CURRENT), + EV_CURRENT); update_section_size (verd); break; |