diff options
| author | Mark Wielaard <[email protected]> | 2014-12-11 16:33:30 +0100 |
|---|---|---|
| committer | Mark Wielaard <[email protected]> | 2014-12-15 10:04:23 +0100 |
| commit | 65a556fc865657ada6355686dedd282d6f1ad863 (patch) | |
| tree | 315ce8753d98b809f8370904454ea49c7dc5411c /libelf | |
| parent | 7d63628b8a72dbeefe8976939c7090f3d1a23311 (diff) | |
libelf: Correct ELF64 section offset check in file_read_elf.
The ELF64 case didn't check for overflow and accidentially used the 32bit
Shdr size.
Signed-off-by: Mark Wielaard <[email protected]>
Diffstat (limited to 'libelf')
| -rw-r--r-- | libelf/ChangeLog | 4 | ||||
| -rw-r--r-- | libelf/elf_begin.c | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e4c58499..cf168e7f 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,5 +1,9 @@ 2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (file_read_elf): Correct ELF64 section offset check. + +2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (read_long_names): Check for offset overflow. (__libelf_next_arhdr_wrlock): Likewise. Sanity check the ar_size. Don't allow it to go beyond end of file. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 99a9c0a0..7fb5fa5b 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -412,8 +412,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, elf->state.elf64.ehdr = ehdr; if (unlikely (ehdr->e_shoff >= maxsize) - || unlikely (ehdr->e_shoff - + scncnt * sizeof (Elf32_Shdr) > maxsize)) + || unlikely (maxsize - ehdr->e_shoff + < scncnt * sizeof (Elf64_Shdr))) goto free_and_out; elf->state.elf64.shdr = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff); |