* [COMMITTED] libelf: gelf_getnote check for offset overflow.
@ 2014-11-14 16:06 Mark Wielaard
0 siblings, 0 replies; only message in thread
From: Mark Wielaard @ 2014-11-14 16:06 UTC (permalink / raw)
To: elfutils-devel
[-- Attachment #1: Type: text/plain, Size: 1382 bytes --]
Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
libelf/ChangeLog | 4 ++++
libelf/gelf_getnote.c | 5 +++--
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 45e220d..4fbe94c 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-14 Mark Wielaard <mjw@redhat.com>
+
+ * gelf_getnote.c (gelf_getnote): Check offset overflow.
+
2014-11-13 Mark Wielaard <mjw@redhat.com>
* elf_getdata.c (__libelf_set_rawdata_wrlock): Fix unsigned overflow
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 1a36855..8bb78c1 100644
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -1,5 +1,5 @@
/* Get note information at the supplied offset.
- Copyright (C) 2007 Red Hat, Inc.
+ Copyright (C) 2007, 2014 Red Hat, Inc.
This file is part of elfutils.
This file is free software; you can redistribute it and/or modify
@@ -62,7 +62,8 @@ gelf_getnote (data, offset, result, name_offset, desc_offset)
/* The data is already in the correct form. Just make sure the
offset is OK. */
- if (unlikely (offset + sizeof (GElf_Nhdr) > data->d_size))
+ if (unlikely (offset > data->d_size
+ || data->d_size - offset < sizeof (GElf_Nhdr)))
{
__libelf_seterrno (ELF_E_OFFSET_RANGE);
offset = 0;
--
1.8.3.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-11-14 16:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-11-14 16:06 [COMMITTED] libelf: gelf_getnote check for offset overflow Mark Wielaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).