diff options
| author | Jakub Jelinek <jakub@redhat.com> | 2014-01-17 19:36:16 +0100 |
|---|---|---|
| committer | Mark Wielaard <mjw@redhat.com> | 2014-01-23 11:31:53 +0100 |
| commit | 720383c53b435de6647edd78060dd7d38ade25a5 (patch) | |
| tree | 7437a0d1e3250ea4916f7caefdff05b218504510 /libelf/elf32_updatefile.c | |
| parent | 58d3619facfb708f4998d73270ca4082b20853b9 (diff) | |
| download | elfutils-720383c53b435de6647edd78060dd7d38ade25a5.tar.gz | |
robustify: libelf.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Diffstat (limited to 'libelf/elf32_updatefile.c')
| -rw-r--r-- | libelf/elf32_updatefile.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libelf/elf32_updatefile.c b/libelf/elf32_updatefile.c index b39e2841..153e377f 100644 --- a/libelf/elf32_updatefile.c +++ b/libelf/elf32_updatefile.c @@ -1,5 +1,5 @@ /* Write changed data structures. - Copyright (C) 2000-2010 Red Hat, Inc. + Copyright (C) 2000-2010, 2014 Red Hat, Inc. This file is part of elfutils. Written by Ulrich Drepper <drepper@redhat.com>, 2000. @@ -202,6 +202,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf, int change_bo, size_t shnum) /* Write all the sections. Well, only those which are modified. */ if (shnum > 0) { + if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *))) + return 1; + Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns; Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *)); char *const shdr_start = ((char *) elf->map_address + elf->start_offset @@ -624,6 +627,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf, int change_bo, size_t shnum) /* Write all the sections. Well, only those which are modified. */ if (shnum > 0) { + if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *) + + sizeof (ElfW2(LIBELFBITS,Shdr))))) + return 1; + off_t shdr_offset = elf->start_offset + ehdr->e_shoff; #if EV_NUM != 2 xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR]; |