diff options
Diffstat (limited to 'libelf')
| -rw-r--r-- | libelf/ChangeLog | 5 | ||||
| -rw-r--r-- | libelf/elf_getdata.c | 11 |
2 files changed, 16 insertions, 0 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 39fbccf2..64141288 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,8 @@ +2016-10-21 Mark Wielaard <mjw@redhat.com> + + * elf_getdata.c (__libelf_set_rawdata_wrlock): Sanity check + offset and size before trying to malloc and read data. + 2016-10-26 Mark Wielaard <mjw@redhat.com> * elf_begin.c (read_file): Always set maxsize when parent == NULL. diff --git a/libelf/elf_getdata.c b/libelf/elf_getdata.c index d1fafbfe..97c503b5 100644 --- a/libelf/elf_getdata.c +++ b/libelf/elf_getdata.c @@ -312,6 +312,17 @@ __libelf_set_rawdata_wrlock (Elf_Scn *scn) } else if (likely (elf->fildes != -1)) { + /* First see whether the information in the section header is + valid and it does not ask for too much. Check for unsigned + overflow. */ + if (unlikely (offset > elf->maximum_size + || elf->maximum_size - offset < size)) + { + /* Something is wrong. */ + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER); + return 1; + } + /* We have to read the data from the file. Allocate the needed memory. */ scn->rawdata_base = scn->rawdata.d.d_buf |