diff options
Diffstat (limited to 'libelf/gelf_getnote.c')
| -rw-r--r-- | libelf/gelf_getnote.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c index 1a368553..7dc82156 100644 --- a/libelf/gelf_getnote.c +++ b/libelf/gelf_getnote.c @@ -1,5 +1,5 @@ /* Get note information at the supplied offset. - Copyright (C) 2007 Red Hat, Inc. + Copyright (C) 2007, 2014 Red Hat, Inc. This file is part of elfutils. This file is free software; you can redistribute it and/or modify @@ -62,7 +62,8 @@ gelf_getnote (data, offset, result, name_offset, desc_offset) /* The data is already in the correct form. Just make sure the offset is OK. */ - if (unlikely (offset + sizeof (GElf_Nhdr) > data->d_size)) + if (unlikely (offset > data->d_size + || data->d_size - offset < sizeof (GElf_Nhdr))) { __libelf_seterrno (ELF_E_OFFSET_RANGE); offset = 0; @@ -72,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, desc_offset) const GElf_Nhdr *n = data->d_buf + offset; offset += sizeof *n; + /* Include padding. Check below for overflow. */ GElf_Word namesz = NOTE_ALIGN (n->n_namesz); GElf_Word descsz = NOTE_ALIGN (n->n_descsz); - if (unlikely (data->d_size - offset < namesz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < namesz + || (namesz == 0 && n->n_namesz != 0))) offset = 0; else { *name_offset = offset; offset += namesz; - if (unlikely (data->d_size - offset < descsz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < descsz + || (descsz == 0 && n->n_descsz != 0))) offset = 0; else { |