diff options
| author | Mark Wielaard <[email protected]> | 2014-12-25 22:50:21 +0100 |
|---|---|---|
| committer | Mark Wielaard <[email protected]> | 2015-01-12 22:02:46 +0100 |
| commit | 68588d628a464698031323d8eb42a961c0846ba9 (patch) | |
| tree | d8d60c63001038466bfb3a8035ee9204c4a63983 /libelf/elf_begin.c | |
| parent | 8f2f5801a16626b56546f2c95be4c85a59c2e53a (diff) | |
libelf: ar_size cannot be negative. Fix max ar size.
Elf_Arhdr ar_size is loff_t, which is signed. Make sure it isn't negative.
When the parent start_offset is non-zero maxsize should include it to
compensate for ar offset.
Found with afl-fuzz.
Signed-off-by: Mark Wielaard <[email protected]>
Diffstat (limited to 'libelf/elf_begin.c')
| -rw-r--r-- | libelf/elf_begin.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index cd3756cc..ae1e7124 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -921,9 +921,16 @@ __libelf_next_arhdr_wrlock (elf) INT_FIELD (ar_mode); INT_FIELD (ar_size); + if (elf_ar_hdr->ar_size < 0) + { + __libelf_seterrno (ELF_E_INVALID_ARCHIVE); + return -1; + } + /* Truncated file? */ size_t maxsize; - maxsize = elf->maximum_size - elf->state.ar.offset - sizeof (struct ar_hdr); + maxsize = (elf->start_offset + elf->maximum_size + - elf->state.ar.offset - sizeof (struct ar_hdr)); if ((size_t) elf_ar_hdr->ar_size > maxsize) elf_ar_hdr->ar_size = maxsize; |