diff options
| author | Mark Wielaard <[email protected]> | 2018-06-11 02:14:34 +0200 |
|---|---|---|
| committer | Mark Wielaard <[email protected]> | 2018-06-11 17:51:13 +0200 |
| commit | 01044a9ed1d58bedb5d7f96f8ff40134d127a6d1 (patch) | |
| tree | 6a365fda43536edab8320a25cacd781eb5edbef9 /src | |
| parent | 340ce2c433b8033e57c0c23e9087ea15a349fd3e (diff) | |
readelf: Fix bounds check in print_form_data.
The afl fuzzer found that we did a wrong check in print_form_data when
comparing the remaining bytes in the buffer to an (unsigned) value read.
We were casting the value to ptrdiff_t which is a signed value and so
might turn a really big unsigned value into a negative number. Since we
know the difference between readendp and readp is zero or greater, we
should cast the pointer difference to size_t (and unsigned type) instead
before comparing with the unsigned value.
Signed-off-by: Mark Wielaard <[email protected]>
Diffstat (limited to 'src')
| -rw-r--r-- | src/ChangeLog | 5 | ||||
| -rw-r--r-- | src/readelf.c | 14 |
2 files changed, 12 insertions, 7 deletions
diff --git a/src/ChangeLog b/src/ChangeLog index 8ebb5fb7..6484b9a5 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,8 @@ +2018-06-10 Mark Wielaard <[email protected]> + + * readelf.c (print_form_data): Don't cast value to ptrdiff_t, cast + ptrdiff_t to size_t. + 2018-06-08 Mark Wielaard <[email protected]> * readelf.c (print_debug_rnglists_section): Calculate max_entries diff --git a/src/readelf.c b/src/readelf.c index bbaaf96a..fbda6c17 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -7880,7 +7880,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, if (readendp - readp < 1) goto invalid_data; get_uleb128 (val, readp, readendp); - if (readendp - readp < (ptrdiff_t) val) + if ((size_t) (readendp - readp) < val) goto invalid_data; print_bytes (val, readp); readp += val; @@ -7890,7 +7890,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, if (readendp - readp < 1) goto invalid_data; val = *readp++; - if (readendp - readp < (ptrdiff_t) val) + if ((size_t) (readendp - readp) < val) goto invalid_data; print_bytes (val, readp); readp += val; @@ -7900,7 +7900,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, if (readendp - readp < 2) goto invalid_data; val = read_2ubyte_unaligned_inc (dbg, readp); - if (readendp - readp < (ptrdiff_t) val) + if ((size_t) (readendp - readp) < val) goto invalid_data; print_bytes (val, readp); readp += val; @@ -7910,7 +7910,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, if (readendp - readp < 2) goto invalid_data; val = read_4ubyte_unaligned_inc (dbg, readp); - if (readendp - readp < (ptrdiff_t) val) + if ((size_t) (readendp - readp) < val) goto invalid_data; print_bytes (val, readp); readp += val; @@ -7941,7 +7941,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, case DW_FORM_strp: case DW_FORM_line_strp: case DW_FORM_strp_sup: - if (readendp - readp < (ptrdiff_t) offset_len) + if ((size_t) (readendp - readp) < offset_len) goto invalid_data; if (offset_len == 8) val = read_8ubyte_unaligned_inc (dbg, readp); @@ -7965,7 +7965,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, break; case DW_FORM_sec_offset: - if (readendp - readp < (ptrdiff_t) offset_len) + if ((size_t) (readendp - readp) < offset_len) goto invalid_data; if (offset_len == 8) val = read_8ubyte_unaligned_inc (dbg, readp); @@ -7988,7 +7988,7 @@ print_form_data (Dwarf *dbg, int form, const unsigned char *readp, { readp = data->d_buf + str_offsets_base + val; readendp = data->d_buf + data->d_size; - if (readendp - readp < (ptrdiff_t) offset_len) + if ((size_t) (readendp - readp) < offset_len) str = "???"; else { |