diff options
| author | Mark Wielaard <[email protected]> | 2017-03-24 12:15:02 +0100 |
|---|---|---|
| committer | Mark Wielaard <[email protected]> | 2017-04-03 23:40:41 +0200 |
| commit | 9d84fdd78705d7a1b9947a9f4ca77fbccdd76d4a (patch) | |
| tree | 5e9f4663a68cb18965acf8ba2abcc1f20c9a190a | |
| parent | 93c51144c3f664d4e9709da75a1d0fa00ea0fe95 (diff) | |
readelf: Fix off by one sanity check in handle_gnu_hash.
We sanity check to make sure we don't index outside the chain array
by testing inner > max_nsyms. But inner is a zero-based index, while
max_nsyms is the maximum number. Change the check to inner >= max_nsyms.
https://sourceware.org/bugzilla/show_bug.cgi?id=21299
Signed-off-by: Mark Wielaard <[email protected]>
| -rw-r--r-- | src/ChangeLog | 5 | ||||
| -rw-r--r-- | src/readelf.c | 2 |
2 files changed, 6 insertions, 1 deletions
diff --git a/src/ChangeLog b/src/ChangeLog index 0601198c..9dd76c00 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,8 @@ +2017-03-24 Mark Wielaard <[email protected]> + + * readelf.c (handle_gnu_hash): Check inner < max_nsyms before + indexing into chain array. + 2017-02-16 Ulf Hermann <[email protected]> * addr2line.c: Include printversion.h diff --git a/src/readelf.c b/src/readelf.c index 8d96ba3f..490b6d59 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -3263,7 +3263,7 @@ handle_gnu_hash (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr, size_t shstrndx) ++nsyms; if (maxlength < ++lengths[cnt]) ++maxlength; - if (inner > max_nsyms) + if (inner >= max_nsyms) goto invalid_data; } while ((chain[inner++] & 1) == 0); |