diff options
| author | Mark Wielaard <mjw@redhat.com> | 2014-11-16 11:30:51 +0100 |
|---|---|---|
| committer | Mark Wielaard <mjw@redhat.com> | 2014-11-16 11:30:51 +0100 |
| commit | 8ea90b7a5c030321d70bea246c989fc18c404a14 (patch) | |
| tree | c2467be3ca1aa575c14b1cf8d34e1cfbe1a5f4de /libelf | |
| parent | 502430c7b2f5ad6bc14a268d8b85e032db970c63 (diff) | |
| download | elfutils-8ea90b7a5c030321d70bea246c989fc18c404a14.tar.gz | |
gelf_getnote: Check padding overflow.
Since ELF notes need to be properly aligned they can include padding.
Make sure the padding itself and the padding calculation doesn't overflow.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Diffstat (limited to 'libelf')
| -rw-r--r-- | libelf/ChangeLog | 4 | ||||
| -rw-r--r-- | libelf/gelf_getnote.c | 9 |
2 files changed, 11 insertions, 2 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 48860939..beb431fd 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,5 +1,9 @@ 2014-11-16 Mark Wielaard <mjw@redhat.com> + * gelf_getnote.c (gelf_getnote): Check padding overflow. + +2014-11-16 Mark Wielaard <mjw@redhat.com> + * elf_getdata.c (__libelf_set_rawdata_wrlock): Declare offset, size and align as Elf64_Off and Elf64_Xword not size_t. diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c index 8bb78c16..7dc82156 100644 --- a/libelf/gelf_getnote.c +++ b/libelf/gelf_getnote.c @@ -73,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, desc_offset) const GElf_Nhdr *n = data->d_buf + offset; offset += sizeof *n; + /* Include padding. Check below for overflow. */ GElf_Word namesz = NOTE_ALIGN (n->n_namesz); GElf_Word descsz = NOTE_ALIGN (n->n_descsz); - if (unlikely (data->d_size - offset < namesz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < namesz + || (namesz == 0 && n->n_namesz != 0))) offset = 0; else { *name_offset = offset; offset += namesz; - if (unlikely (data->d_size - offset < descsz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < descsz + || (descsz == 0 && n->n_descsz != 0))) offset = 0; else { |