[COMMITTED] libelf: gelf_getnote check for offset overflow.

[COMMITTED] libelf: gelf_getnote check for offset overflow.

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 1382 bytes --]

Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
 libelf/ChangeLog      | 4 ++++
 libelf/gelf_getnote.c | 5 +++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 45e220d..4fbe94c 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-14  Mark Wielaard  <mjw@redhat.com>
+
+	* gelf_getnote.c (gelf_getnote): Check offset overflow.
+
 2014-11-13  Mark Wielaard  <mjw@redhat.com>
 
 	* elf_getdata.c (__libelf_set_rawdata_wrlock): Fix unsigned overflow
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 1a36855..8bb78c1 100644
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -1,5 +1,5 @@
 /* Get note information at the supplied offset.
-   Copyright (C) 2007 Red Hat, Inc.
+   Copyright (C) 2007, 2014 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -62,7 +62,8 @@ gelf_getnote (data, offset, result, name_offset, desc_offset)
 
   /* The data is already in the correct form.  Just make sure the
      offset is OK.  */
-  if (unlikely (offset + sizeof (GElf_Nhdr) > data->d_size))
+  if (unlikely (offset > data->d_size
+		|| data->d_size - offset < sizeof (GElf_Nhdr)))
     {
       __libelf_seterrno (ELF_E_OFFSET_RANGE);
       offset = 0;
-- 
1.8.3.1