diff options
Diffstat (limited to 'libelf')
| -rw-r--r-- | libelf/ChangeLog | 4 | ||||
| -rw-r--r-- | libelf/elf_begin.c | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e4c58499..cf168e7f 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,5 +1,9 @@ 2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (file_read_elf): Correct ELF64 section offset check. + +2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (read_long_names): Check for offset overflow. (__libelf_next_arhdr_wrlock): Likewise. Sanity check the ar_size. Don't allow it to go beyond end of file. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 99a9c0a0..7fb5fa5b 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -412,8 +412,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, elf->state.elf64.ehdr = ehdr; if (unlikely (ehdr->e_shoff >= maxsize) - || unlikely (ehdr->e_shoff - + scncnt * sizeof (Elf32_Shdr) > maxsize)) + || unlikely (maxsize - ehdr->e_shoff + < scncnt * sizeof (Elf64_Shdr))) goto free_and_out; elf->state.elf64.shdr = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff); |